High
CVE-2026-28151
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-28153
Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 - Missing Authorization
High
CVE-2026-66650
FreightCo – Free Transportation & Logistics WordPress Theme <= 1.1.15 - Unauthenticated PHP Object Injection
High
CVE-2026-66586
WP Cafe Pro <= 3.0.14 - Authenticated (Author+) Local File Inclusion
High
CVE-2026-78478
Måne <= 1.7 - Unauthenticated Local File Inclusion
High
CVE-2026-66671
Verdure Core <= 1.2 - Unauthenticated Local File Inclusion
High
CVE-2026-66587
WP Cafe Pro <= 3.0.14 - Unauthenticated Local File Inclusion
High
CVE-2026-66680
Locatoraid Store Locator <= 3.9.72 - Unauthenticated SQL Injection
High
CVE-2026-66672
Flatastic <= 2.0 - Unauthenticated PHP Object Injection
High
CVE-2026-28152
Tonda Core < 2.6 - Unauthenticated Local File Inclusion
Critical
CVE-2026-32475
Elementor Pro <= 4.2.1 - Unauthenticated Arbitrary File Upload via Upload Field Array Validation Bypass
Medium
CVE-2026-17153
AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint
High
CVE-2026-75963
Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
High
CVE-2025-15637
Shuffle <= 1.8 - Unauthenticated Local File Inclusion
High
CVE-2026-66582
TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-73387
Resido - Real Estate WordPress Theme <= 1.5 - Unauthenticated Local File Inclusion
Medium
CVE-2025-53999
Altair <= 5.2.2 - Missing Authorization
High
CVE-2026-28150
Golo Framework < 1.7.5 - Unauthenticated Local File Inclusion
Medium
CVE-2026-74012
Tag, Category, and Taxonomy Manager – Autotagger Automatically Add Terms <= 3.51.0 - Authenticated (Editor+) PHP Object Injection
Critical
CVE-2026-74001
User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 5.4.5 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-73364
Flexible Subscriptions <= 1.8.1 - Authenticated (Customer+) PHP Object Injection
High
CVE-2026-73389
Kalles Addons <= 1.0.6 - Unauthenticated PHP Object Injection
High
CVE-2026-73993
FundEngine – Donation and Crowdfunding Platform <= 1.7.9 - Unauthenticated PHP Object Injection
High
CVE-2026-66596
Newsletter – Send awesome emails from WordPress <= 9.3.3 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.