High
CVE-2026-61964
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,533
High
CVE-2026-28139
Ajax Search Lite – Live Search & Filter <= 4.14.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-11870
WP Ghost (Hide My WP Ghost) – Security & Firewall < 7.0.05 - IP Spoofing to Protection Mechanism Bypass
Medium
CVE-2026-13178
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass
High
CVE-2026-66439
Advanced AJAX Product Filters <= 3.2.0.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-17540
Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2026-66694
Thrive Visual Editor <= 10.9.3.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66457
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-15381
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection
High
CVE-2026-61963
Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66708
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.17.2 - Missing Authorization
High
CVE-2026-15038
InfiniteWP Client <= 1.13.5 - Unauthenticated Administrator Account Takeover on Multi-Site
Medium
CVE-2026-17542
Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-16032
LWS Optimize <= 4.1.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-12376
Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-66709
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.42 - Authenticated (Shop Manager+) Remote Code Execution
High
CVE-2026-14845
NewStatPress < 1.4.5 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-28005
Kadence WooCommerce Email Designer <= 1.5.19 - Unauthenticated Privilege Escalation
Medium
CVE-2026-16295
Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer < 2.4.3 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-69246
Guzzle: Noncanonical host can bypass host-based checks
Medium
CVE-2026-69245
Guzzle: Noncanonical cookie domain keeps subdomain scope
Critical
CVE-2026-69240
Sequelize: SQL Injection (Oracle DB)
Medium
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-Headers
High
CVE-2026-69192
ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.