Medium
CVE-2026-104724
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,401
Medium
CVE-2026-87869
Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
Medium
CVE-2026-104735
RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
High
CVE-2026-104021
Fastcache by Host.it <= 1.7.4 - Authenticated (Administrator+) Code Injection via .htaccess Directive Injection via 'cache_cookie_exclude' Setting
Critical
CVE-2026-103889
3D Product configurator for WooCommerce <= 2.16.2 - Unauthenticated Remote Code Execution via 'xpv_image' Parameter
Medium
CVE-2026-103424
Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
Medium
CVE-2026-103964
Download Manager <= 3.3.71 - Authenticated (Subscriber+) Sensitive Information Exposure via Email Template Token Injection in 'first_name' Profile Field Token Injection into Suspension Email
Medium
CVE-2026-102401
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
Medium
CVE-2026-96648
Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
High
CVE-2026-89301
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
Critical
CVE-2026-94589
Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) <= 3.4.5 - Unauthenticated Arbitrary File Upload via Signature Field File Upload
Medium
CVE-2026-104898
Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String / JSON Body
Medium
CVE-2026-103365
Online Scheduling and Appointment Booking System <= 28.4 - Unauthenticated Sensitive Information Exposure in 'phone' Parameter to bookly_render_details
Critical
CVE-2026-107645
Blocksy Companion <= 2.1.58 - Unauthenticated Privilege Escalation to 'role' Parameter
Blocksy Companion allows unauthenticated attackers to gain Dokan vendor privileges and automatic login during registration, even if vendor signup is turned off.
Critical
CVE-2026-104732
Advanced IP Blocker <= 8.13.13 - Unauthenticated Authentication Bypass via Missing Step-1 Binding to 2FA Login Handler
High
CVE-2026-104797
Advanced Form Integration <= 2.9.0 - Unauthenticated Unverified Password Change to Authentication Bypass / Privilege Escalation via Contact Form 7 Submission to Ultimate Member Update Profile Field Action
Medium
CVE-2026-96743
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
Medium
CVE-2026-93883
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
Medium
CVE-2026-104915
Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id
Low
CVE-2026-107727
Strawberry legacy graphql-ws retains naturally completed subscription slots
High
CVE-2026-107728
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
Medium
CVE-2026-107419
AutoPoly – AI Translation For Polylang <= 1.6.2 - Missing Authorization
Medium
CVE-2026-62029
WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell <= 3.13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-62039
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player <= 2.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.