High
CVE-2026-16636
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-15991
File Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter
High
CVE-2026-18325
Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
Medium
CVE-2026-53949
Ghost Content API filter bypass reveals private fields
Medium
CVE-2026-70596
Ghost: Cross-Site Scripting in Feature Image Captions
Medium
CVE-2026-70595
Ghost: Server-Side Request Forgery Mitigation Issue
Medium
CVE-2026-48197
PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation
Medium
CVE-2026-28183
PublishPress Capabilities: User Role Access Control, Admin Area Permissions <= 2.45.0 - Authenticated (Editor+) Privilege Escalation
High
CVE-2026-16298
FoodBoxBooker <= 1.0.6 - Privilege Escalation to Unauthenticated Arbitrary Password Reset
Medium
CVE-2026-66452
Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 - Missing Authorization
Critical
CVE-2026-18468
Login & Register Forms <= 4.0.1 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-66712
Simple Membership <= 4.7.8 - Missing Authorization
High
CVE-2026-66663
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.79 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-17010
Saitama Addon Pack < 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-66425
Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization
Medium
CVE-2026-17008
Quick Paypal Payments < 5.7.51 - Unauthenticated Payment Bypass
High
CVE-2026-14592
WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28172
Tracking Code Manager <= 2.6.0 - Cross-Site Request Forgery
Medium
CVE-2026-16604
Passster – Password Protect Pages and Content < 4.3.6 - Missing Authorization
Medium
CVE-2026-66451
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.9 - Missing Authorization
High
CVE-2026-13596
Participants Database < 2.7.8.4 - Unauthenticated SQL Injection
Medium
CVE-2026-11782
Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-12966
Direct Payments for WooCommerce – Bank Transfer, Mobile Money, Crypto and Peer-to-Peer (P2P) Payments < 2.5.3 - Missing Authorization
Medium
CVE-2026-28169
YITH WooCommerce Zoom Magnifier <= 2.52.0 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.