Medium
CVE-2026-39534
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2026-39551
Töbel - Modern Furniture Store WordPress Theme <= 1.8.1 - Unauthenticated PHP Object Injection
High
CVE-2026-39582
Hitek < 1.8.3 - Unauthenticated Local File Inclusion
Medium
CVE-2026-57784
Ninja Forms File Uploads Extension <= 3.3.26 - Cross-Site Request Forgery
High
CVE-2026-39533
AWP Classifieds <= 4.4.4 - Missing Authorization
High
CVE-2026-39576
SingleMalt <= 1.5 - Unauthenticated PHP Object Injection
High
CVE-2026-39558
Malmö <= 2.2 - Unauthenticated Local File Inclusion
High
CVE-2026-39519
GeekyBot — AI Copilot, Chatbot, WooCommerce Lead Gen & Zero-Prompt Content <= 1.2.0 - Unauthenticated SQL Injection
High
CVE-2026-39591
WP-BusinessDirectory – Business directory plugin for WordPress <= 4.0.0 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-39578
Valiance <= 1.2 - Unauthenticated PHP Object Injection
High
CVE-2026-39539
Alloggio - Hotel Booking WordPress Theme <= 2.1.2 - Unauthenticated PHP Object Injection
High
CVE-2026-39547
Getaway < 1.8 - Unauthenticated Local File Inclusion
High
CVE-2026-4326
Vertex Addons for Elementor <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation and Activation via 'afeb_activate_required_plugins'
Medium
CVE-2026-3005
List category posts <= 0.94.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'catlist' Shortcode
Medium
CVE-2026-4124
Ziggeo <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'ziggeo_ajax' AJAX Action
High
CVE-2026-39492
WP Maps – Store Locator,Google Maps,OpenStreetMap,Mapbox,Listing,Directory & Filters <= 4.9.1 - Unauthenticated SQL Injection
Medium
CVE-2026-39480
BackupBliss – Backup & Migration with Free Cloud Storage <= 2.1.1 - Unauthenticated Information Exposure
High
CVE-2025-15611
Popup Box – Create Countdown, Coupon, Video, Contact Form Popups < 5.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39502
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.38 - Unauthenticated SQL Injection
Medium
CVE-2026-1865
User Registration & Membership <= 5.1.2 - Authenticated (Subscriber+) SQL Injection via membership_ids[]
Medium
CVE-2026-2481
Beaver Builder Page Builder – Drag and Drop Website Builder <= 2.10.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'settings[js]'
High
CVE-2026-39847
Emmett has a path traversal in internal assets handler
Medium
CVE-2026-5739
PowerJob's GroovyEvaluator.evaluate endpoint vulnerable to code injection
Medium
CVE-2026-5736
PowerJob vulnerable to SQL injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.