High
CVE-2026-103354
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
High
CVE-2026-95606
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-102798
ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-19856
All in One SEO <= 5.0.2.0 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2026-39600
Aculect AI Companion <= 0.8.2 - Missing Authorization to Unauthorized Redirects
Medium
CVE-2026-102797
ThemeREX Addons <= 2.46.0 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-86817
Five Star Business Profile and Schema 2.3.20 - 2.3.21 - Authenticated (Author+) Information Exposure
Medium
CVE-2026-78371
File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-84169
UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-93549
CoCart 4.9.0 - 4.9.6 - Cross-Site Request Forgery to Privilege Escalation
Medium
CVE-2026-13607
File Uploads Addon for WooCommerce <= 1.7.6 - Missing Authorization
High
CVE-2026-93430
GD Rating System <= 3.7.1 - Unauthenticated Stored Cross-Site Scripting via 'title' and 'url' Render Args in gdrts_live_handler AJAX
Medium
CVE-2026-104119
Simple Shopping Cart <= 5.2.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-39601
Booking Calendar <= 11.8.4 - Unauthenticated Duplicate Slot Booking
Medium
CVE-2026-32582
IATO MCP <= 1.12.0 - Missing Authorization
Medium
CVE-2026-104118
Razorpay for WooCommerce <= 4.8.7 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-97332
User Private Files <= 2.1.0 - Missing Authorization
Critical
CVE-2026-94541
WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter
High
CVE-2026-87920
W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Medium
CVE-2026-97652
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
Medium
CVE-2026-85492
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
High
CVE-2026-103426
Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
High
CVE-2026-97641
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
Low
CVE-2026-102002
Otter Blocks <= 3.2.6 - Authenticated (Subscriber+) Sensitive Information Exposure in Form Submissions Dashboard Widget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.