High
CVE-2026-28175
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-73403
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 5.2.6 - Missing Authorization
Critical
CVE-2026-61979
SAML Single Sign On – SSO Login <= 5.4.3 - Unauthenticated Privilege Escalation
Medium
CVE-2026-14229
ECS <= 4.3.7 - Missing Authorization to Unauthenticated Private Content Disclosure
Medium
CVE-2026-61984
WPMobile.App <= 11.77 - Missing Authorization
High
CVE-2026-61980
OMGF Pro <= 5.2.7 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-28155
Do Lasso <= 358 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-28173
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce <= 4.1.19 - Authenticated (Customer+) Arbitrary Content Deletion
Medium
CVE-2026-28157
Do Lasso <= 358 - Authenticated (Subscriber+) Path Traversal
Medium
CVE-2026-73401
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization
Medium
CVE-2026-18216
Backup Migration <= 2.1.6 - Authenticated (Administrator+) Privilege Escalation
Medium
CVE-2026-12976
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-14922
WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-16541
Simply Schedule Appointments <= 1.6.12.16 - Authenticated (Team Member+) Information Exposure
Medium
CVE-2026-28181
AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization
High
CVE-2026-61974
Mang Board WP <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-28189
Participants Database <= 2.7.8.4 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-14239
Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28170
Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28191
The Grid <= 2.7.9.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-16611
Product Feed PRO for WooCommerce <= 13.5.6 - Unauthenticated Information Exposure
Medium
CVE-2026-28186
Travelfic Toolkit <= 1.5.1 - Missing Authorization
High
CVE-2026-28176
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-28156
Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.