Medium
CVE-2026-105890
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,529
Medium
CVE-2026-86828
BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Authenticated (Administrator+) Path Traversal
Medium
CVE-2026-105197
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2026-105891
Event Tickets and Registration <= 5.30.0.1 - Missing Authorization
Medium
CVE-2026-86827
BackWPup – WordPress Backup & Restore Plugin 3.3 - 5.7.6 - Missing Authorization
Medium
CVE-2026-105079
MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.7.52 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-105260
Database Addon For WPForms ( wpforms entries ) – WPFormsDB < 1.1.1 - Cross-Site Request Forgery
Medium
CVE-2026-86826
BackWPup – WordPress Backup & Restore Plugin < 5.7.7 - Unauthenticated Information Exposure
High
CVE-2026-103309
GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI < 2.34.14 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66479
WPComplete <= 2.9.5.6 - Cross-Site Request Forgery
Medium
CVE-2026-94244
Wallet System for WooCommerce – Digital Wallet, Buy Now Pay Later (BNPL), Instant Cashback, Referral program, Partial & Subscription Payments < 2.8.0 - Missing Authorization
Medium
CVE-2026-103070
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-104645
Image Photo Gallery Final Tiles Grid < 3.6.14 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-106596
Visual Composer Website Builder <= 45.16.3 - Missing Authorization
Medium
CVE-2026-106603
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.14 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-103072
VillaTheme Core <= 1.0.5 - Missing Authorization
Medium
CVE-2026-105078
WP Store Locator <= 3.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-103692
Frontend Dashboard 3.0.0 - 3.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2026-105193
Booking Calendar < 11.8 - Unauthenticated Information Exposure
Medium
CVE-2026-62127
WP Plugin Info Card <= 6.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-61439
PraisonAI: Prompt Injection Defense Bypassed for HIGH-Level Threats
High
CVE-2026-105642
Ghost: Remote Code Execution via Bookmark Card Images
High
CVE-2026-105643
Ghost: Stored XSS via Embed Card Previews
Medium
CVE-2026-105644
Ghost : Stored XSS via SVG Files in Content Imports
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.