Medium
CVE-2026-11356
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-13422
HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers
High
CVE-2026-49486
The Apache Airflow FTP provider's `FTPSHook.get_conn()` created an `ftplib.FTP_TLS` connection but never called `prot_p()`, so although the control channel was TLS-protected the data channel was trans
Medium
CVE-2026-57640
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.30 - Missing Authorization
High
CVE-2026-11961
User Registration & Membership <= 5.2.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-63041
Forget About Shortcode Buttons <= 2.1.3 - Missing Authorization
Medium
CVE-2026-57631
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups <= 6.0.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-57644
Restaurant Menu and Food Ordering <= 2.4.10 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-57637
Abandoned Cart Lite for WooCommerce <= 6.8.0 - Cross-Site Request Forgery
Medium
CVE-2026-57642
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.8 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-57646
Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.1.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2025-68052
Eagle Booking <= 1.3.4.3 - Cross-Site Request Forgery
Medium
CVE-2026-57659
Paid Memberships Pro - Add Member From Admin <= 0.7.2 - Cross-Site Request Forgery
Medium
CVE-2026-57634
PPWP – Password Protect Pages <= 1.9.19 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-57648
Nelio Content – Editorial Calendar & Social Media Auto-Posting <= 4.3.4 - Missing Authorization
High
CVE-2025-68063
Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-66123
BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-3462
Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification
Medium
CVE-2026-57323
HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.11.0 - Missing Authorization
Medium
CVE-2026-57661
WPComplete <= 2.9.5.5 - Missing Authorization
Medium
CVE-2026-57635
FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 - Cross-Site Request Forgery
Medium
CVE-2026-57638
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-57660
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 - Missing Authorization
Medium
CVE-2026-57656
Hester Core <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.