High
CVE-2026-17533
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 494
Reset filters
Medium
CVE-2026-16253
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid < 1.17.3 - Unauthenticated Information Exposure
Medium
CVE-2026-18216
Backup Migration <= 2.1.6 - Authenticated (Administrator+) Privilege Escalation
High
CVE-2026-13457
InstaWP Connect <= 0.1.3.6 - Unauthenticated Cryptographic Key Disclosure
High
CVE-2026-66472
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.12 - Unauthenticated SQL Injection
Medium
CVE-2026-66642
WP Umbrella: Security Backup Restore & Monitoring 2.24.2-2.26.2 - Cross-Site Request Forgery
High
CVE-2026-7693
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter
Medium
CVE-2026-66708
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.17.2 - Missing Authorization
Medium
CVE-2026-17555
WPvivid <= 0.9.131 - Authenticated (Administrator+) SQL Injection via 'export_data' Parameter
Medium
CVE-2026-15012
Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy
Critical
CVE-2026-14490
Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action
High
CVE-2026-65443
BackWPup <= 5.7.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-15802
WP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX Action
Medium
CVE-2026-14503
pCloud WP Backup <= 2.0.3 - Missing Authorization on the 'start_backup' AJAX Method to Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2026-14333
Demi - One Click Demo Import, Backup & Site Migration <= 0.0.6 - Unauthenticated Sensitive Data Exposure
Medium
CVE-2026-3552
SurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action
Medium
CVE-2026-8996
Backup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function
Medium
CVE-2026-57757
pCloud WP Backup <= 2.0.7 - Cross-Site Request Forgery
High
CVE-2026-5821
Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
High
CVE-2026-9834
WP Database Backup <= 7.11 - Authenticated (Administrator+) OS Command Injection via 'wp_db_exclude_table' Parameter
Critical
CVE-2026-6070
WP-BusinessDirectory <= 4.0.1 - Unauthenticated Arbitrary File Deletion via Path Traversal via '_filename' Parameter
Medium
CVE-2026-12898
All-in-One WP Migration and Backup <= 7.105 - Missing Authorization
Medium
CVE-2026-54839
Trinity Backup – Backup, Migrate, Restore, Clone & Schedule Backups <= 2.0.9 - Unauthenticated Information Exposure
High
CVE-2018-25437
Cherry Framework <= 3.1.4 - Unauthenticated Backup Download
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.