Medium
CVE-2026-86815
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 494
Reset filters
High
CVE-2026-77006
WebTotem Backups < 1.1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-18386
WP BackItUp Community Edition <= 2.1.0 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'backup_file' Parameter
Medium
CVE-2026-81804
ZHBackup – Backup, Restore & Migration <= 2.4.2 - Unauthenticated Information Exposure
High
CVE-2026-75927
PublishPress Capabilities <= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant
High
2ae1c18c-5be3-48db-af31-4c88daa549fc
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Unauthenticated Stored Cross-Site Scripting
Medium
b94d50a1-f2ba-4c0e-9a10-5294b8ce7ad8
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
9e822e6f-dfb7-4aaa-aa26-cc4c25ffec5f
Jetpack – WP Security, Backup, Speed, & Growth 16.1 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
f72c0a27-9602-4465-a14a-15c2a34e578b
Jetpack 3.2 - 16.1.2 - Missing Authorization on WPCOM Media API Attachment Parent
Medium
eda9ae01-cdc4-43e0-8a4c-1ec365939fa8
Jetpack 14.5 - 16.1.2 - Reflected to Stored Cross-Site Scripting via Reader Repost Parameters
Medium
CVE-2026-19453
JetBackup – Backup, Restore & Migrate 3.1.7.9 - 3.1.23.3 - Authenticated (Subscriber+) Privilege Escalation
High
72f4776f-5450-4022-92dd-47ddaa91a5cd
Jetpack 12.0 - 16.1.2 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-82182
WPvivid — Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) SQL Injection
High
CVE-2026-82193
WPvivid — Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2026-82194
WPvivid — Backup, Migration & Staging < 0.9.134 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2026-75133
Keep Backup Daily <= 2.1.3 - Unauthenticated Sensitive Information Exposure
High
CVE-2026-19722
WPvivid — Backup, Migration & Staging < 0.9.133 - Authenticated (Administrator+) Remote Code Execution
Medium
CVE-2026-6128
All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
Medium
CVE-2026-76549
UpdraftPlus: WP Backup & Migration Plugin < 1.26.7 - Cross-Site Request Forgery
Medium
CVE-2026-81278
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App 4.0.0-beta.1 - Missing Authorization to Authenticated (Subscriber+) Settings Change
Medium
CVE-2026-19454
JetBackup – Backup, Restore & Migrate 3.1.18.8 - 3.1.23.3 - Authenticated (Admin+) Backup Download
High
CVE-2026-19949
All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Execution
Critical
CVE-2026-19718
The WP Remote WordPress Plugin, Malcare Security, and BlogVault Backup & Staging < 6.65 - Unauthenticated Site Takeover via Brute Force
High
CVE-2026-19725
WPvivid — Backup, Migration & Staging < 0.9.131 - Unauthenticated Path Traversal
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.