Medium
CVE-2026-16285
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2025-15675
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) < 1.8.5.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-15151
Five Star Restaurant Reservations – WordPress Booking Plugin < 2.7.23 - Missing Authorization
Medium
CVE-2026-14938
FluentBoards – Project Management, Task Management, Goal Tracking, Kanban Board, and, Team Collaboration < 1.95.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-16064
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Missing Authorization
Medium
CVE-2026-16292
Frontend File Manager Plugin <= 23.6 - Cross-Site Request Forgery
Medium
CVE-2026-16042
LWS Optimize – All-in-One Speed Booster & Cache Tools < 3.4 - Missing Authorization
Medium
CVE-2026-16273
Narrative Publisher <= 1.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-16291
ProfileGrid – User Profiles, Groups and Communities < 5.9.9.8 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-14817
Element Pack Addons for Elementor – Elementor Widgets, Elementor Templates, Elementor Addons < 8.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-15248
Meta Box < 5.13.1 - Authenticated (Contributor+) Insecure Direct Object Reference
High
CVE-2026-16062
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-14864
JetEngine < 3.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-11872
Clever Mega Menu for Visual Composer <= 1.0.1 - Missing Authorization
High
CVE-2026-67326
GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath
Critical
CVE-2026-8457
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
High
CVE-2026-18352
User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
High
CVE-2026-13339
CubeWP Framework <= 1.1.30 - Unauthenticated Arbitrary File Read via prev_icon/next_icon Parameter
Medium
CVE-2026-61972
ShopLentor Pro <= 2.8.5 - Missing Authorization
Medium
CVE-2026-61973
ShopLentor Pro <= 2.8.5 - Missing Authorization
Medium
CVE-2026-14214
Booking for Appointments and Events Calendar – Amelia < 2.4.4 - Missing Authorization
Medium
CVE-2025-15669
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-61977
JetSearch <= 3.6.1.2 - Unauthenticated Information Exposure
Medium
CVE-2026-14839
Mapster WP Maps < 1.24.0 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.