High
CVE-2026-4609
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,547
Medium
CVE-2025-14767
WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'text' Attribute
Medium
CVE-2026-42669
EventPrime – Events Calendar, Bookings and Tickets <= 4.3.2.0 - Missing Authorization
Medium
CVE-2026-25431
Hustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.1 - Missing Authorization
Medium
CVE-2026-45217
Payment Gateway of Stripe for WooCommerce <= 5.0.7 - Missing Authorization
Critical
CVE-2026-6433
Custom css-js-php <= 2.0.7 - Unauthenticated Remote Code Execution
Medium
CVE-2026-2515
Hostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update
Medium
CVE-2026-42725
Checkout Files Upload for WooCommerce <= 2.2.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-3426
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification
Medium
CVE-2026-4607
ProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification
High
CVE-2026-7635
coreActivity: Activity Logging for WordPress <= 3.0 - Unauthenticated PHP Object Injection via 'user_agent' Log Meta Field
Medium
CVE-2026-4608
ProfileGrid <= 5.9.8.4 - Authenticated (Subscriber+) SQL Injection via 'rid' Parameter
High
CVE-2026-3425
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
Medium
CVE-2026-42726
AWP Classifieds <= 4.4.5 - Missing Authorization
Medium
CVE-2026-45209
MyCryptoCheckout – Bitcoin, Ethereum, and 100+ altcoins for WooCommerce <= 2.161 - Missing Authorization
Medium
CVE-2026-42670
Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.14 - Missing Authorization
High
CVE-2026-45216
Smart Manager – Advanced WooCommerce Bulk Edit & Inventory Management <= 8.85.0 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2026-2614
MLflow allows an unauthenticated remote attacker to read arbitrary files from the server's filesystem
Medium
CVE-2026-45222
@steipete/summarize allows local attackers to read bearer tokens and API credentials stored in ~/.summarize/daemon.json
Medium
CVE-2026-6813
Continually <= 4.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'continually_embed_code' Parameter
Medium
CVE-2026-6800
FastBots <= 1.0.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-1934
Motors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter
High
CVE-2026-44657
MantisBT Vulnerable to Stored XSS in File Download
High
CVE-2026-44655
MantisBT has Stored XSS on Move Attachments Admin Page
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.