Medium
CVE-2026-8622
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,528
Medium
CVE-2026-9172
Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint
Medium
CVE-2026-9175
Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter
High
CVE-2026-9178
WP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint
High
CVE-2026-9179
WP Forms Connector <= 1.8 - Unauthenticated SQL Injection via 'order' Parameter
Medium
CVE-2026-9184
24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action
Medium
CVE-2026-9183
24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization
Medium
CVE-2026-8905
Osiris Signature Banner <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'prepend_text' Parameter
Medium
CVE-2026-8690
RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action
Medium
CVE-2026-8688
Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action
Medium
CVE-2026-8617
SearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions
Medium
CVE-2026-8614
Assistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action
Medium
CVE-2026-7617
Secufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Action
Medium
CVE-2026-6292
MP Customize Login Page <= 1.0 - Cross-Site Request Forgery to Settings Update
Critical
CVE-2026-12416
Invoice Generator <= 1.0.0 - Unauthenticated Account Takeover via Weak Password Reset Validation via 'reset_user_id' Parameter
Critical
CVE-2026-12417
SignUp & SignIn <= 1.0.0 - Unauthenticated Privilege Escalation via Weak Password Reset Validation via 'reset_activation_code' Leading to Account Takeover
High
CVE-2026-8705
ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection
High
CVE-2026-10092
Cincopa video and media plug-in <= 1.163 - Unauthenticated Stored Cross-Site Scripting via cincopa Shortcode in Post Comments
High
CVE-2026-10091
Email JavaScript Cloak <= 1.03 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-11614
Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets
High
CVE-2026-3652
ARForms <= 7.1.1 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter
High
CVE-2026-56258
Crawl4AI: Arbitrary file write (symlink/TOCTOU) plus log and webhook-header injection in Docker server
Unrated
860
JCE - Other
Critical
CVE-2026-12866
expr-eval vulnerable to Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.