Medium
CVE-2026-78290
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Medium
CVE-2026-77789
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-77758
Stripe Payment Forms by WP Full Pay – Accept Credit Card Payments, Donations & Subscriptions < 8.5.1 - Unauthenticated Information Exposure
High
CVE-2026-28166
Tour Master - Tour Booking, Travel, Hotel <= 5.4.9 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-16747
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.2.1 - Unauthenticated Remote Code Execution
Medium
CVE-2026-19435
Duplicate Post < 1.5.6 - Missing Authorization
Medium
CVE-2026-16959
Media Library Assistant < 3.40 - Authenticated (Author+) SQL Injection
Medium
CVE-2026-13176
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.21 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-77694
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.19 - Unauthenticated Order Completion
Medium
CVE-2026-75796
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation
Medium
CVE-2026-16962
Tamara Checkout <= 1.9.9.20 - Unauthenticated Payment Bypass
Medium
CVE-2026-14601
Link Whisper Free < 0.9.7 - Authenticated (Editor+) SQL Injection
High
CVE-2026-32559
UltimateAI <= 3.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-78278
Fluent Boards Pro <= 2.0.11 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-78279
Fluent Support Pro <= 2.3.1 - Cross-Site Request Forgery
Medium
CVE-2026-32471
ProLancer Element <= 1.4.8 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-15150
Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred < 3.2.5 - Unauthenticated Payment Bypass
Medium
CVE-2026-16577
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Missing Authorization
Medium
CVE-2026-28190
ProLancer Element <= 1.4.8 - Missing Authorization
Medium
CVE-2026-19085
Duplicate Post < 1.5.6 - Missing Authorization
Medium
CVE-2026-17559
Passster – Password Protect Pages and Content < 4.3.9 - Missing Authorization
High
CVE-2026-32551
Woo Essential <= 4.3.0 - Unauthenticated SQL Injection
Medium
CVE-2026-78259
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages <= 3.7.0 - Missing Authorization
Medium
CVE-2026-78258
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.