Low
CVE-2026-104742
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 281
Reset filters
Low
CVE-2026-104741
AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint
High
CVE-2026-40803
Jotform – AI Chatbot <= 3.8.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-32579
Kognetiks Chatbot <= 2.4.9 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-97305
Hyve Lite – AI Chatbot Trained on WordPress Posts, Pages, Products & More with ChatGPT <= 2.0.2 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-94378
SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter
Medium
CVE-2026-94539
SupportCandy <= 3.5.3 - Authenticated (Custom+) SQL Injection via 'sort_by' Parameter
High
CVE-2026-96561
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
High
CVE-2026-95531
WPBot – ChatBot Conversational Forms <= 1.5.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-93623
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.7.8 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-89141
AI Engine <= 3.7.7 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Attachment Disclosure via 'mediaId' Parameter
Medium
CVE-2026-87959
WPBot 8.7.2 - 8.7.5 - Missing Authorization
Medium
CVE-2026-87918
WPBot – AI ChatBot for Live Support, Lead Generation, WordPress Automation, AI Services < 8.5.7 - Missing Authorization
Medium
CVE-2026-87916
WPBot <= 8.5.9 - Unauthenticated Information Exposure
Medium
CVE-2026-81022
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.3.6 - 3.5.2 - Unauthenticated Information Exposure
High
CVE-2026-83593
WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
Medium
CVE-2026-81021
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Read
Medium
CVE-2026-75980
BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
High
CVE-2026-19806
Support Genix <= 1.4.52 - Authenticated (Subscriber+) Authentication Bypass to Administrator Account Takeover via 'p' Parameter Forged Guest Token
Medium
CVE-2026-75798
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.4.0 - 3.7.1 - Missing Authorization to Unauthenticated Arbitrary AI Query Execution
Medium
CVE-2026-75797
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-78268
Lead Generation Contact Widget & AI Chatbot: Chat Button, Phone Call, Telegram, Email – SiteLeads <= 1.2.0 - Unauthenticated Information Exposure
Medium
CVE-2026-75796
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.6.0 - Authenticated (Administrator+) Privilege Escalation
Medium
CVE-2026-73350
SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent <= 3.5.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.