High
CVE-2026-77006
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2026-77005
CODE MONKEYS PROPOSALS – Easily create client proposals from your WordPress admin dashboard <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2024-0757
Insert or Embed Articulate Content into WordPress < 4.3000000025 - Authenticated (Author+) Arbitrary File Upload
Critical
CVE-2026-81648
CryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-87892
Rox Appointment Booking – Appointment Booking Scheduling Solution < 1.2.0 - Payment Bypass to Unauthenticated Arbitrary Booking Price and Payment Method Bypass
Medium
CVE-2026-18386
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
High
CVE-2026-15019
Direct Download for WooCommerce <= 1.19 - Unauthenticated Arbitrary File Read via 'file_id' Path Segment
Critical
CVE-2026-81789
Advanced Product Fields Extended for WooCommerce <= 3.1.6 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-81803
RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1224 - Authenticated (Subscriber+) Remote Code Execution
Critical
CVE-2026-14560
Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Arbitrary File Upload
High
CVE-2026-26212
Rara One Click Demo Import <= 1.3.4 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2026-86779
Visualizer – Tables & Charts Manager with Built-in AI Generator < 4.0.6 - Authenticated (Contributor+) Arbitrary File Deletion
Medium
CVE-2026-19802
Checkout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter
High
CVE-2026-76801
FireBox <= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation
High
CVE-2026-15667
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
High
CVE-2026-15406
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
Medium
CVE-2026-81275
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.7 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2026-81806
Hide My WP Ghost – Security & Firewall <= 7.0.09 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-83537
Express Checkout <= 2.4.0 - Unauthenticated Payment Bypass
Medium
CVE-2026-83543
Greenshift – animation and page builder blocks < 13.2.0 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2026-75586
Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter
Medium
CVE-2026-14975
WP File Download <= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter
Medium
CVE-2026-3853
Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Medium
CVE-2026-4361
Divi <= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.