Low
CVE-2026-10215
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Critical
CVE-2026-27395
Support Board < 3.8.9 - Unauthenticated Privilege Escalation
High
CVE-2026-27410
SlimStat Analytics < 5.4.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-48869
Enfold - Responsive Multi-Purpose Theme <= 7.1.4 - Reflected Cross-Site Scripting
High
CVE-2026-48839
WP Statistics – Simple, privacy-friendly Google Analytics alternative <= 14.16.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42378
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions <= 8.4.1 - Missing Authorization
Critical
CVE-2026-48879
AI Chatbot & Workflow Automation by AIWU <= 1.4.17 - Unauthenticated Privilege Escalation
Critical
CVE-2026-48836
Easy Invoice – Invoice Generator, PDF Quotes & Payments <= 2.1.19 - Unauthenticated Remote Code Execution
High
CVE-2026-48876
Stop Spammers Classic <= 2026.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-25439
Booknetic <= 4.8.5 - Missing Authorization
Medium
CVE-2026-48872
EmbedPress – PDF Embedder, Embed PDF viewer, YouTube Videos, 3D FlipBook, Social feeds & more <= 4.5.2 - Unauthenticated Information Exposure
High
CVE-2026-8157
Vitepos – Point of Sale (POS) for WooCommerce < 3.4.2 - Authenticated (Outlet Manager+) Privilege Escalation
High
CVE-2026-39435
cformsII <= 15.1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-27089
Travelly – Tour & Travel Booking Manager for WooCommerce | Tour & Hotel Booking Solution <= 2.1.7 - Missing Authorization
Medium
CVE-2026-48883
WPC Product Bundles for WooCommerce <= 8.5.3 - Missing Authorization
High
CVE-2026-45437
Product Filter Widget for Elementor <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-48866
Gravity Forms <= 2.10.0.1 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-42761
Active Products Tables for WooCommerce. Use constructor to create tables <= 1.0.9 - Unauthenticated SQL Injection
High
CVE-2026-39451
WP Google Review Slider <= 18.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42762
VikBooking Hotel Booking Engine & PMS <= 1.8.9 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-48865
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses <= 4.3.6 - Reflected Cross-Site Scripting
High
CVE-2026-48871
MW WP Form <= 5.1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-8382
Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters
High
CVE-2026-42754
Favicon by RealFaviconGenerator <= 1.3.46 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.