Medium
CVE-2026-12133
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-10513
Webmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties
Medium
CVE-2026-27433
Motors - Car Dealer, Rental & Listing WordPress theme <= 5.6.80 - Missing Authorization
Medium
CVE-2026-27408
NativeChurch <= 4.8.8.2 - Reflected Cross-Site Scripting
High
CVE-2026-13693
Bit Form <= 3.0.0 - Unauthenticated Arbitrary File Read
High
CVE-2026-27402
Kids Life | Children School WordPress <= 5.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57675
WP Photo Album Plus <= 9.2.02.004 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-27414
Werkstatt - Creative Portfolio WordPress Theme <= 4.8.3 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2025-69155
Fitness Zone WordPress <= 5.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57678
Slider Revolution 7.0.0-7.0.16 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57682
Simple Link Directory Pro <= 15.0.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57686
Product Addons and Product Options With Custom Fields – WowAddons <= 1.6.14 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27404
LMS <= 9.7 - Reflected Cross-Site Scripting
High
CVE-2026-27060
ARMember Premium – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 7.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-13694
Bit Form <= 3.0.0 - Missing Authorization
High
CVE-2026-27436
Five Star Business Profile and Schema <= 2.3.19 - Authenticated (Editor+) Arbitrary Code Execution
Medium
CVE-2026-14184
Academy LMS <= 3.8.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Note/Progress Modification
High
CVE-2026-57671
Perfmatters <= 2.6.4 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57681
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.161 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-12902
Kadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions
Medium
CVE-2026-57669
Advanced Contact form 7 DB <= 2.0.9 - Missing Authorization
Medium
CVE-2026-57680
Kirki <= 6.0.11 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-27426
Automotive Car Dealership Business WordPress Theme <= 13.3.3 - Reflected Cross-Site Scripting
Medium
CVE-2026-14183
Classified Listing <= 5.3.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) Receipt Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.