Medium
CVE-2026-15260
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-16300
Chama <= 1.0.12 - Missing Authorization
High
CVE-2026-15931
Simple Membership <= 4.7.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-65564
MapPress – Google Maps, OpenStreetMap & Leaflet <= 2.97.6 - Unauthenticated Information Exposure
High
CVE-2026-59553
Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces <= 7.6.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-12965
Super Store Finder <= 7.10 - Unauthenticated SQL Injection
Medium
CVE-2026-15930
Simple Membership <= 4.7.7 - Missing Authorization
Medium
CVE-2026-16289
ProfileGrid <= 5.0.0.0 - Missing Authorization
Medium
CVE-2026-13340
SVG Support <= 2.5.16 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-65563
Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More <= 3.0.7 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-15673
Import and export users and customers < 2.4.3 - Authenticated (Admin+) Arbitrary File Read
Medium
CVE-2026-16539
SM Page Duplicator <= 1.0.0 - Authenticated (Editor+) SQL Injection
High
CVE-2026-59556
Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-15231
TaxoPress <= 3.50.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Private Post Disclosure
Medium
CVE-2026-16297
Clearfy <= 2.4.2 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2026-16623
Create Block <= 2.9.0 - Code Injection to Authenticated (Admin+) PHP Code Injection
Medium
CVE-2026-16564
Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Arbitrary Order Status Modification
Medium
CVE-2026-16563
Academy LMS <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Lesson Content Disclosure
Critical
CVE-2026-16618
ImproveSEO <= 2.0.11 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-65562
BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-17032
Multiple Supsystic Pro Plugins <= 1.6.0 - Backdoored Software via Compromised Vendor Software
Medium
CVE-2026-65561
miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-65557
Abandoned Cart Lite for WooCommerce <= 6.8.0 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Medium
CVE-2026-16565
Dokan <= 5.0.8 - Insecure Direct Object Reference to Authenticated (Vendor+) Cross-Vendor Product Attribute Modification
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.