Medium
CVE-2026-18752
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
High
CVE-2026-75921
Master Addons for Elementor <= 3.1.9 - Incorrect Authorization to Authenticated (Editor+) Arbitrary File Upload via upload_template_kit AJAX ZIP Extraction
Medium
CVE-2026-77823
LearnPress <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter
Medium
CVE-2026-81287
Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) <= 1.8.12.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-81280
Print Labels with Barcodes. Create price tags, product labels, order labels for WooCommerce <= 4.0.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-75133
Keep Backup Daily <= 2.1.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-77010
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
Medium
CVE-2026-74927
MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions 5.0.13 - 5.0.14 - Unauthenticated Information Exposure
High
CVE-2026-16061
Rest Routes – Custom Endpoints for WordPress REST API <= 5.5.5 - Unauthenticated SQL Injection
High
CVE-2026-75807
SAML Single Sign On <= 5.4.6 - Unauthenticated Authentication Bypass via X.509 Certificate Poisoning
Medium
CVE-2026-77007
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Unauthenticated Information Exposure
Medium
CVE-2026-80488
WP Ultimate CSV Importer – WordPress CSV, XML & Excel Import < 9.0 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-81763
Throws SPAM Away <= 3.8.2 - Unauthenticated SQL Injection
Medium
bb4c2021-c4b0-4283-9022-a2a6a76bbce8
WP Rocket 3.23.1 - 3.23.3.2 - Unauthenticated Information Exposure
Medium
CVE-2026-19715
WP OAuth Server ( Login with WordPress ) < 6.3.1 - Unauthenticated Information Exposure
Medium
CVE-2026-82227
WPBulky – WordPress Bulk Edit Post Types <= 1.2.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-16984
Privacy Policy Generator, Terms & Conditions, GDPR, CCPA, Cookie Policy & Disclaimer Templates – WPLP Legal Pages < 3.7.1 - Unauthenticated Information Exposure
High
CVE-2026-81756
Smart Marketing SMS and Newsletters Forms <= 5.1.24 - Unauthenticated SQL Injection
High
CVE-2026-81293
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.81 - Unauthenticated SQL Injection
Medium
CVE-2026-14567
User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission < 4.3.10 - Unauthenticated Information Exposure
Medium
CVE-2026-13611
KiviCare – Clinic & Patient Management System (EHR) <= 4.5.4 - Unauthenticated Information Exposure
Medium
CVE-2026-16759
Tutor LMS <= 4.0.5 - Unauthenticated Remote Code Execution via 'template' and 'data' POST Parameters
High
CVE-2026-5097
wpForo Forum <= 2.4.17 - Unauthenticated SQL Injection via 'referer' Parameter
Medium
CVE-2026-77017
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Read
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.