Medium
CVE-2026-78270
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-16149
Security Hardener <= 2.4.4 - Authenticated (Subscriber+) Privilege Escalation via REST API '/wp/v2/users' permission_callback Overwrite
High
CVE-2026-0551
PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
Medium
CVE-2026-18027
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter
Medium
CVE-2026-4559
Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute
Medium
CVE-2026-75027
Themify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action
Medium
CVE-2026-76057
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
Medium
CVE-2026-76074
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action
High
CVE-2026-19883
WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
Medium
CVE-2026-32478
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2026-18937
Broken Link Checker < 2.4.12 - Unauthenticated Remote Code Execution
Medium
CVE-2026-18779
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Missing Authorization
Medium
CVE-2026-18778
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Information Exposure
Medium
CVE-2026-78470
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2026-4703
WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
Medium
CVE-2026-19699
GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor <= 2.4.15 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-19417
KiviCare – Clinic & Patient Management System (EHR) < 4.5.4 - Missing Authorization
Medium
CVE-2026-18202
JetEngine < 3.8.14 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-14853
WooCommerce Bookings <= 3.8.0 - Missing Authorization
High
CVE-2026-18051
W3 Total Cache < 2.10.5 - Unauthenticated Path Traversal
High
CVE-2026-16616
Simple File List <= 6.3.11 - Unauthenticated Arbitrary File Read
Medium
CVE-2026-4245
Post Duplicator <= 3.0.11 - Authorization Bypass to Authenticated (Contributor+) Post Duplication
High
CVE-2026-18776
TrueBooker – Appointment Booking and Scheduler System < 1.2.7 - Unauthenticated Privilege Escalation
Medium
CVE-2026-77013
爱采集数据采集和发布插件 <= 1.0.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.