Medium
CVE-2026-57659
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
Medium
CVE-2026-57634
PPWP – Password Protect Pages <= 1.9.19 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-57648
Nelio Content – Editorial Calendar & Social Media Auto-Posting <= 4.3.4 - Missing Authorization
High
CVE-2025-68063
Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-66123
BookPro - Appointment Booking WordPress Plugin <= 1.1.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-3462
Frisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification
Medium
CVE-2026-57323
HTML5 Video Player – Embed and Play Videos in Custom Player <= 2.11.0 - Missing Authorization
Medium
CVE-2026-57661
WPComplete <= 2.9.5.5 - Missing Authorization
Medium
CVE-2026-57635
FunnelKit Payment Gateway for Stripe WooCommerce <= 1.14.0.3 - Cross-Site Request Forgery
Medium
CVE-2026-57638
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-57660
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.1 - Missing Authorization
Medium
CVE-2026-57656
Hester Core <= 1.1.8 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-57321
Interactive Content – H5P <= 1.17.7 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2025-68064
Goya Core < 1.0.9.4 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-57325
NanoMag <= 1.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-57322
weMail – Email Marketing, Newsletter Builder & Email Automations for WooCommerce <= 2.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-57657
Gmail SMTP <= 1.2.3.19 - Cross-Site Request Forgery
Medium
CVE-2026-12393
WPS Bookings for WooCommerce <= 3.11.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Booking Order Cancellation
Medium
CVE-2026-57645
Newsletters <= 4.13 - Missing Authorization
Medium
CVE-2025-68075
BNE Testimonials <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-57620
Exclusive Addons for Elementor <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-57643
WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars <= 3.9.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-12083
Admin and Site Enhancements <= 8.8.3 - Missing Authorization
Medium
CVE-2026-57654
Affiliates Manager <= 2.9.49 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.