Medium
CVE-2026-73603
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-70475
Flowise: Missing Authorization on Execution Update Endpoint
Medium
CVE-2026-11969
WP TripAdvisor Review Slider <= 14.3 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-11920
JoomSport <= 5.7.9 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
High
CVE-2026-7520
MailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action
High
7bbead7c-47b9-473f-b335-6fae4b5998d6
Contact Form Extender for Divi Builder <= 1.0.6 - Unauthenticated Arbitrary File Deletion via Path Traversal
High
CVE-2026-6020
ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
Medium
CVE-2026-11454
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
Medium
CVE-2026-7105
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
Medium
CVE-2026-15281
User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-15307
Django GeoDjango spatial lookups allow file writes and outbound requests through GDAL raster parsing
Medium
CVE-2026-15830
Django GeoDjango vulnerable to denial of service through deeply nested geometry collections
Medium
CVE-2026-7456
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
High
CVE-2026-18881
TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
Critical
CVE-2026-5581
Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
High
CVE-2026-6079
Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
Medium
CVE-2026-17532
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
Medium
CVE-2026-17505
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
High
CVE-2026-6147
LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload
High
CVE-2026-12000
Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
High
CVE-2026-6627
WPFormify <= 1.1.1 - Missing Authorization
Medium
CVE-2026-6972
SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-7693
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter
Medium
CVE-2026-5116
Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.