Medium
CVE-2026-39484
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-25312
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.8.3 - Missing Authorization
Medium
CVE-2026-25317
Print Invoice & Delivery Notes for WooCommerce <= 5.9.0 - Missing Authorization
Medium
CVE-2026-42644
BetterDocs <= 4.3.10 - Unauthenticated Information Exposure
Medium
CVE-2026-25437
GZSEO <= 2.0.14 - Missing Authorization
High
CVE-2026-24989
SUMO Affiliates Pro < 11.4.0 - Unauthenticated PHP Object Injection
High
CVE-2026-25429
Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE <= 1.1.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39476
User Feedback <= 1.10.1 - Missing Authorization
Medium
CVE-2026-25442
Kentha <= 4.7.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-42645
Barcode Scanner with Inventory & Order Manager <= 1.11.0 - Cross-Site Request Forgery
High
CVE-2026-25443
Fraud Prevention For WooCommerce and EDD <= 2.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Medium
CVE-2026-32565
Contextual Related Posts < 4.2.2 - Missing Authorization
Medium
CVE-2026-24362
Ultimate Post Kit Addons for Elementor <= 4.0.21 - Missing Authorization
High
CVE-2026-24993
Advanced Reporting & Statistics for WooCommerce – Orders, Products & Customers Reporting <= 4.1.3 - Unauthenticated SQL Injection
High
CVE-2026-25446
Wishlist Member <= 3.32.0 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-4338
ActivityPub < 8.0.2 - Unauthenticated Information Epxosure
Medium
CVE-2026-4120
Info Cards <= 2.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes
Medium
CVE-2026-25430
Integration for Mailchimp and Contact Form 7, WPForms, Elementor, Ninja Forms <= 1.2.2 - Missing Authorization
Medium
CVE-2026-25013
Phox Hosting <= 2.0.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-24376
WPVulnerability <= 4.2.1 - Missing Authorization
Medium
CVE-2026-25438
Gutenberg Blocks – Unlimited blocks For Gutenberg <= 1.2.8 - Reflected Cross-Site Scripting
High
CVE-2026-25435
Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-32981
A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1. Due to improper validation and sanitization of user-supplied paths in the static file
Medium
CVE-2026-1217
Yoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.