Medium
CVE-2026-17541
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
High
CVE-2026-27096
ColorFolio - Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-18030
Bricksforge <= 3.1.8.7 - Unauthenticated Privilege Escalation via Password Reset
High
CVE-2026-12720
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection
Medium
CVE-2026-28140
JetFormBuilder — Dynamic Blocks Form Builder <= 3.6.4.1 - Missing Authorization
High
CVE-2026-13392
ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor < 3.10.01 - Authenticated (Admin+) Remote Code Execution
Medium
CVE-2026-14928
JS Help Desk – AI-Powered Support & Ticketing System < 3.1.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-13143
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Unauthenticated Payment Bypass
High
CVE-2026-61964
Ninja Tables – Easy Data Table Builder <= 5.2.9 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28139
Ajax Search Lite – Live Search & Filter <= 4.14.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-11870
WP Ghost (Hide My WP Ghost) – Security & Firewall < 7.0.05 - IP Spoofing to Protection Mechanism Bypass
Medium
CVE-2026-13178
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.16 - Unauthenticated Payment Bypass
High
CVE-2026-66439
Advanced AJAX Product Filters <= 3.2.0.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-17540
Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2026-66694
Thrive Visual Editor <= 10.9.3.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-66457
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-15381
WP Go Maps – Google Map, OpenStreetMap, Leaflet Map < 10.1.04 - Unauthenticated SQL Injection
High
CVE-2026-61963
Media Library Assistant <= 3.38 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-66708
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.17.2 - Missing Authorization
High
CVE-2026-15038
InfiniteWP Client <= 1.13.5 - Unauthenticated Administrator Account Takeover on Multi-Site
Medium
CVE-2026-17542
Bit File Manager <= 6.9.0 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-16032
LWS Optimize <= 4.1.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-12376
Academy LMS <= 3.8.2 - Authenticated (Subscriber+) Information Exposure
High
CVE-2026-66709
Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels <= 6.6.42 - Authenticated (Shop Manager+) Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.