Medium
CVE-2026-8841
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-8977
WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' AJAX Action
Medium
CVE-2026-8499
Helpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update
Medium
CVE-2026-7662
ePaperFlip Publisher <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'publicationid' Shortcode Attribute
Medium
CVE-2026-5714
Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
High
CVE-2026-7556
FV Flowplayer Video Player <= 7.5.49.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Text
Medium
CVE-2026-10862
Accordions <= 2.3.23 - Authenticated (Custom+) Stored Cross-Site Scripting via Accordion Body Field
Critical
CVE-2026-47430
Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViews.
Low
CVE-2026-11477
hsweb-framework has an open redirect issue
Low
CVE-2026-11470
hsweb-framework has a Path Traversal issue
High
CVE-2026-49061
WPC Product Options for WooCommerce <= 3.2.1 - Unauthenticated Arbitrary File Download
High
CVE-2026-49076
JetEngine <= 3.8.9.1 - Unauthenticated SQL Injection
Critical
CVE-2026-49058
LoginPress Pro <= 6.2.2 - Unauthenticated Privilege Escalation
High
CVE-2026-49069
WPZOOM Portfolio Lite – Filterable Portfolio Plugin <= 1.4.21 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-49074
JetEngine <= 3.8.9.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-49066
Conekta Payment Gateway <= 6.0.0 - Unauthenticated Information Exposure
Critical
CVE-2026-49063
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.5.0 - Unauthenticated Privilege Escalation
High
CVE-2026-49080
wpDataTables (Premium) <= 7.3.6 - Unauthenticated SQL Injection
High
CVE-2026-49075
JetEngine <= 3.8.9.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-49071
WooCommerce Dropshipping Premium <= 5.2.4 - Missing Authorization
High
CVE-2026-49772
The Events Calendar 6.15.12-6.16.2 - Unauthenticated SQL Injection
Medium
CVE-2026-49064
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.49 - Unauthenticated Information Exposure
High
CVE-2026-10083
APCu Manager <= 4.4.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-49067
Advanced 301 and 302 Redirect <= 1.6.9 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.