Medium
CVE-2026-78277
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-75796
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation
High
CVE-2026-32559
UltimateAI <= 3.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-16577
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Missing Authorization
Medium
CVE-2026-78259
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages <= 3.7.0 - Missing Authorization
Medium
CVE-2026-16575
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy < 5.0.14 - Unauthenticated Information Exposure
Medium
CVE-2026-74928
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation
Medium
CVE-2026-78291
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1223 - Missing Authorization
High
CVE-2026-32560
MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator <= 1.4 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2026-78270
FluentCRM Pro <= 3.1.12 - Authenticated (Author+) SQL Injection
High
CVE-2026-0551
PPWP – Password Protect Pages <= 1.9.18 - Authenticated (Contributor+) PHP Object Injection via post_protection_roles
Medium
CVE-2026-18027
WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 4.9.8 - Authenticated (Subscriber+) Arbitrary File Read via 'customer_note' Parameter
Medium
CVE-2026-76057
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action
Medium
CVE-2026-76074
AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action
High
CVE-2026-19883
WPeMatico RSS Feed Fetcher <= 2.8.24 - Authenticated (Subscriber+) Privilege Escalation via Arbitrary Option Update to wpematico_import_settings admin_action
Critical
CVE-2026-4703
WS Form LITE <= 1.10.80 - Unauthenticated PHP Object Injection via Form Submission
Medium
CVE-2026-4561
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
High
CVE-2026-2996
Advanced Product Fields (Product Addons) for WooCommerce <= 1.6.21 - Unauthenticated Improper Input Validation to Price Bypass via Add-to-Cart POST Request
Critical
CVE-2026-78003
Mailgun for WordPress <= 2.2.0 - Unauthenticated Server-Side Request Forgery (SSRF) via 'addresses' Array Keys
Critical
CVE-2026-77264
Automation Web Platform <= 4.8.6 - Unauthenticated Authentication Bypass via 'otp_transient' Token Disclosure
High
CVE-2026-66670
Mane <= 1.7 - Unauthenticated Local File Inclusion
Medium
CVE-2026-19726
Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.7 - Missing Authorization
Critical
CVE-2026-76793
Firebase Authentication < 1.7.1 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-18044
Estatik Real Estate Plugin < 4.3.4 - Unauthenticated Mail Relay
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.