Medium
CVE-2026-90922
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2026-76550
Import Export Lite <= 3.9.33 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-84906
Eventin <= 4.1.23 - Unauthenticated Payment Bypass
High
CVE-2026-76552
Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Upload
Critical
b8a7a925-2b9e-43bc-b649-c7ec518e063c
Advanced Custom Fields: Extended PRO <= 0.9.2.6 - Unauthenticated Remote Code Execution via Dynamic Render Field Type
Critical
CVE-2026-84171
WP images upload on piclect <= 1.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-76555
Import Export Lite <= 3.9.32 - Authenticated (Admin+) Arbitrary File Read
High
CVE-2026-80494
Yogeta WP Cloud <= 1.0 - Unauthenticated Arbitrary File Read
Critical
CVE-2026-81402
DS Ad Rotator <= 0.8 - Unauthenticated Arbitrary File Upload
High
CVE-2026-76551
Import Export Lite <= 3.9.32 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-76559
Import Export Lite <= 3.9.32 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2026-84025
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Authenticated (Custom Role+) Insecure Direct Object Reference
Medium
CVE-2026-84023
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Cross-Site Request Forgery
Medium
CVE-2026-84024
BEAR – Bulk Editor for WooCommerce Professional. AI assistant on board (MCP Server) < 1.2.2 - Cross-Site Request Forgery
High
CVE-2026-85200
GEO my WP <= 4.5.5.3 - Unauthenticated Local File Inclusion
High
CVE-2026-78175
Tutor LMS <= 4.0.7 - Authenticated (Subscriber+) PHP Object Injection to Remote Code Execution
Critical
CVE-2026-78159
The Events Calendar <= 6.17.3 - Unauthenticated Code Injection to Remote Code Execution via Widget 'classes' Map Callable Invocation
Critical
CVE-2026-78006
The Events Calendar <= 6.17.4 - Unauthenticated PHP Object Injection to Remote Code Execution
Medium
CVE-2026-89050
Quads Ads Manager for Google AdSense 3.0.4 - Authenticated (Subscriber+) Payment Bypass to Unpaid Ad Placement Acquisition
High
CVE-2026-18579
WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-18964
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting
High
CVE-2026-19991
UsersWP <= 1.2.70 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2026-8778
MIPL Grouped Checkout Fields for WooCommerce <= 1.2.2 - Unauthenticated Arbitrary File Upload
High
CVE-2026-77807
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 11.0.4 - Unauthenticated Arbitrary File Read via 'user[name]' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.