High
CVE-2026-78271
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-78257
Booking and Rental Manager for Bike | Car | Resort | Appointment | Dress | Equipment <= 2.7.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-3235
WP Data Access – No-Code App Builder with Tables, Forms, Charts & Maps <= 5.5.68 - Unauthenticated Insecure Direct Object Reference to Data Access
Medium
CVE-2026-75908
Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter
High
CVE-2026-75971
ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodes
High
CVE-2026-19949
All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
Medium
CVE-2026-76128
eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
Medium
CVE-2026-18100
MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
Medium
CVE-2026-18512
TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
Medium
CVE-2026-12561
tagDiv Composer <= 5.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-19892
InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure
Medium
CVE-2026-75930
FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter
Medium
CVE-2026-76063
FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
Medium
CVE-2026-14280
Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
Medium
CVE-2026-10627
Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters
Medium
CVE-2026-75982
LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter
Medium
CVE-2026-75019
Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
High
CVE-2026-78262
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker <= 4.0.6 - Unauthenticated PHP Object Injection
Medium
CVE-2026-78266
AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI <= 5.8.3 - Missing Authorization
Medium
CVE-2026-78268
Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 - Unauthenticated Information Exposure
High
CVE-2026-78267
TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Privilege Escalation
High
CVE-2026-78265
The Events Calendar <= 6.17.2 - Unauthenticated PHP Object Injection
High
CVE-2026-32563
ACPT (Premium) <= 2.0.63 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-32561
Booking Hub - AI-Powered Scheduling, Reservation and Appointment System for WordPress <= 1.3.0 - Authenticated (Subscriber+) Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.