Medium
CVE-2026-92829
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-96039
BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter
Critical
CVE-2026-14281
Automation Web Platform <= 4.8.6 - Unauthenticated Privilege Escalation via 'wawp_custom_fields' Parameter
High
CVE-2026-83591
AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
High
CVE-2026-63493
Snipe-IT: 2FA bypass via the API token flow
Medium
CVE-2026-97058
sprintf-js vulnerable to denial of service through unbounded precision specifiers
Medium
CVE-2025-14814
CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
Critical
CVE-2026-59167
SunEditor: Critical XSS vulnerability - sanitizer bypass
Medium
CVE-2026-62998
REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
Medium
CVE-2026-94178
Import and export users and customers <= 2.5.2 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-19708
File Manager 7.2.2 - 8.0.4 - Unauthenticated Information Exposure
High
CVE-2026-96352
YITH WooCommerce Ajax Search <= 2.28.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-97246
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.5 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-97237
JetEngine <= 3.8.14.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-89411
Paymattic <= 4.6.25 - Unauthenticated Payment Bypass
High
CVE-2026-84069
WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated Local File Inclusion
Medium
CVE-2026-84097
Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-16591
Directory Kit <= 1.5.7 - Authenticated (Listing Admin+) Stored Cross-Site Scripting
High
CVE-2026-94121
10Web Booster – Website speed optimization, Cache & Page Speed optimizer <= 2.33.6 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-96814
Product Table & List Builder for WooCommerce <= 5.6.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-97245
SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments <= 4.7.2 - Authenticated (Shop Worker+) Privilege Escalation
High
CVE-2026-94076
GEO Plugin by Squirrly SEO <= 14.2.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-84095
Review Slider Pro <= 12.7.11 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-96338
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.