Medium
CVE-2026-5096
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-77008
HEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2026-78139
Notifima – WooCommerce Stock Manager, Inventory Management, Waitlist < 3.1.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-81285
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.2.0 - Unauthenticated Denial of Service
Medium
CVE-2026-77017
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-75797
AI Engine – The Chatbot, AI Framework & MCP for WordPress 3.3.3 - 3.7.1 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2026-77018
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-78138
Finale Lite – Sales Countdown Timer & Discount for WooCommerce < 2.21.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-13414
CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Missing Authorization to Unauthenticated Settings Change
Medium
CVE-2026-81299
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.9 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-81757
Rank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.276 - Authenticated (Author+) Remote Code Execution
High
CVE-2026-15990
Formidable Charts <= 2.0.1 - Unauthenticated Arbitrary File Read via 'frm_graph' Parameter
Medium
CVE-2026-81278
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
Medium
CVE-2026-78276
Fluent Boards Pro <= 2.0.11 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2026-78146
Simple Newsletter Plugin – Noptin < 4.3.3 - Missing Authorization
Medium
CVE-2026-74930
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker 2.2.0 - 4.0.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-74929
Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time Tracker < 4.0.7 - Authenticated (Subscriber+) Insecure Direct Object Reference
Critical
CVE-2026-18080
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.8 - Unauthenticated Arbitrary File Upload via CRM Email Connect IMAP Attachment
Critical
CVE-2026-18431
Avada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write
Critical
CVE-2026-19632
TranslatePress – Multilingual <= 3.3.1 - Unauthenticated Account Takeover via Password Reset Link Disclosure
High
CVE-2026-78292
Hash Form – Drag & Drop Form Builder <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-77016
Workeera – AI Job Board with Applicant Tracking System (ATS) < 1.0.6 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-78286
Geo Controller <= 8.9.8 - Unauthenticated PHP Object Injection
Medium
CVE-2026-13416
CMP – Coming Soon & Maintenance Plugin by NiteoThemes < 4.1.18 - Authenticated (Editor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.