Medium
CVE-2026-40724
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-39597
WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.4 - Reflected Cross-Site Scripting
High
CVE-2026-40738
Eldon - Artist Portfolio WordPress Theme <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40735
Reina <= 2.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40731
ChapterOne <= 1.7 - Unauthenticated Local File Inclusion
High
CVE-2026-40727
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4 - Authenticated (Sales Representative+) Arbitrary File Deletion
Medium
CVE-2026-40786
MyRewards <= 5.7.3 - Missing Authorization
Medium
CVE-2026-39548
MagOne <= 9.0 - Reflected Cross-Site Scripting
High
CVE-2026-40733
ShiftUp <= 1.3 - Unauthenticated PHP Object Injection
High
CVE-2026-39579
bBlocks – Essential Gutenberg Blocks & Patterns Collection <= 2.0.31 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2026-39532
Events Calendar for GeoDirectory <= 2.3.25 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-39507
Social Slider Feed <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24972
Elated Listing <= 1.4 - Missing Authorization
Medium
CVE-2026-40726
User Registration Stripe <= 1.3.14 - Missing Authorization
Medium
CVE-2026-39593
HAPPY – Helpdesk Support Ticket System <= 1.0.10 - Missing Authorization
High
CVE-2026-39598
Academy LMS Pro < 3.5.2 - Authenticated (Custom+) Arbitrary File Upload
High
CVE-2026-40720
Royal Elementor Addons < 1.7.1041 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-39594
Ultra Addons for WPForms <= 1.0.11 - Missing Authorization
Medium
CVE-2026-40741
Payment Gateway for Redsys & WooCommerce Lite <= 7.0.0 - Missing Authorization
High
CVE-2026-40736
Laurits <= 1.5.1 - Unauthenticated PHP Object Injection
High
CVE-2026-40739
LuxeDrive - Limousine and Car Rental WordPress Theme <= 1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-40308
My Calendar < 3.7.7 - Unauthenticated Denial of Service
High
CVE-2026-40192
FITS GZIP decompression bomb in Pillow
Medium
CVE-2026-3369
Better Find and Replace – AI-Powered Suggestions <= 1.7.9 - Authenticated (Author+) Stored Cross-Site Scripting via Uploaded Image Title
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.