Critical
CVE-2026-14300
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,404
High
CVE-2026-9253
WP Cost Estimation & Payment Forms Builder (E&P Forms) <= 10.5.97 - Unauthenticated Stored Cross-Site Scripting via 'customerInfos' Parameter
High
CVE-2026-13441
EventPrime <= 4.3.4.2 - Unauthenticated Stored Cross-Site Scripting via 'new_event_type_background_color' Parameter
Medium
CVE-2026-57419
Stock Locations for WooCommerce <= 3.1.8 - Missing Authorization
High
CVE-2026-11974
Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Read
Critical
CVE-2026-57768
Houzez Login Register <= 3.3.3 - Unauthenticated Privilege Escalation
High
CVE-2026-57396
Free Gifts for WooCommerce <= 13.1.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57392
Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress Plugin <= 2.22.5 - Missing Authorization
High
CVE-2026-57389
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion
High
CVE-2026-57415
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) <= 4.7.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57398
Real Estate Manager Pro <= 12.8.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57401
SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (SureDash User+) Arbitrary File Deletion
Medium
CVE-2026-4653
Block, Suspend, Report for BuddyPress <= 3.6.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link' Parameter
Medium
CVE-2026-6740
Nexter Blocks <= 4.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'commentIcon' Block Attribute
Medium
CVE-2026-5459
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Subscription Overwrite
Medium
ghsa-f66q-9rf6-8795
Flask-Security-Too: WebAuthn reauthentication freshness bypass via cross-user assertion
Medium
ghsa-q855-8rh5-jfgq
ha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
High
CVE-2026-6820
VikBooking Hotel Booking Engine & PMS <= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via Booking Form Email Field
Low
ghsa-gq4g-fpc9-vjfq
Webauthn: SimpleFakeCredentialGenerator with an empty secret produces predictable fake credentials, weakening username enumeration protection
Medium
CVE-2026-6459
Essential Addons for Elementor <= 6.6.2 - Authenticated (Author+) Stored Cross-Site Scripting via Event Calendar Widget Popup
High
CVE-2026-5356
LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
High
CVE-2026-3688
WCFM - WooCommerce Multivendor Membership <= 2.11.10 - Insecure Direct Object Reference to Limited Privilege Escalation via User Role Overwrite
Medium
CVE-2026-6742
Advanced iFrame <= 2026.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutenberg Block 'additional' Attribute
High
CVE-2026-6854
My Calendar <= 3.7.8 - Unauthenticated SQL Injection via 'mc_auth' and 'mc_host' Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.