Medium
CVE-2026-8420
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-8419
Amazon Scraper <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Update
Medium
CVE-2026-8418
Games Catalog <= 1.2.0 - Cross-Site Request Forgery to Arbitrary Game/Post Deletion
Medium
CVE-2026-7462
VatanSMS WP SMS <= 1.01 - Reflected Cross-Site Scripting via 'page' Parameter
High
CVE-2026-6456
Account Switcher <= 1.0.2 - Authenticated (Subscriber+) Authentication Bypass to Privilege Escalation
Medium
CVE-2026-6452
Bigfishgames Syndicate <= 1.2 - Cross-Site Request Forgery to Settings Reset and Update
Medium
CVE-2026-6404
Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter
Medium
CVE-2026-6401
Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-6400
Child Height Predictor by Ostheimer <= 1.3 - Cross-Site Request Forgery to Settings Update via Plugin Settings Form
Medium
CVE-2026-6399
General Options <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ad_contact_number' Parameter
Medium
CVE-2026-6397
Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
Medium
CVE-2026-6395
Word 2 Cash <= 0.9.2 - Cross-Site Request Forgeryto Stored Cross-Site Scripting via Settings Page
Medium
CVE-2026-6394
Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
Medium
CVE-2026-6391
Sentence To SEO (keywords, description and tags) <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via Settings Page Parameters
Critical
CVE-2026-6555
ProSolution WP Client <= 2.0.0 - Unauthenticated Arbitrary File Upload via 'files'
Medium
CVE-2026-8038
Faces of Users <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'default' Shortcode Attribute
Medium
CVE-2026-6072
Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Medium
CVE-2026-5293
診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter
Medium
CVE-2026-8922
Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured
Medium
CVE-2026-8830
Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation
High
CVE-2026-8073
Kirki <= 6.0.6 - Unauthenticated Limited Arbitrary File Read and Deletion via downloadZIP
Medium
CVE-2026-8096
Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
High
CVE-2026-3430
Creative Mail <= 1.6.9 - Unauthenticated SQL Injection
Medium
CVE-2026-47100
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.15.0.2 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.