Medium
CVE-2026-3577
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 494
Reset filters
Low
CVE-2026-3339
Keep Backup Daily <= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter
High
CVE-2026-3090
Post SMTP <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'event_type'
Medium
CVE-2026-2559
Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
Medium
CVE-2026-3903
Modular Connector <= 2.5.1 - Cross-Site Request Forgery via postConfirmOauth
Medium
CVE-2026-2589
Greenshift – animation and page builder blocks <= 12.8.3 - Unauthenticated Sensitive Information Exposure via Settings Backup
High
CVE-2026-1311
Worry Proof Backup <= 0.2.4 - Authenticated (Subscriber+) Path Traversal via Backup Upload
High
CVE-2025-15041
BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update
Medium
CVE-2026-1787
LearnPress Export Import <= 4.1.0 - Missing Authentication to Unauthenticated Migrated Course Deletion
High
CVE-2026-1104
FastDup – Fastest WordPress Migration & Duplicator <= 2.7.1 - Missing Authorization to Authenticated (Contributor+) Backup Creation and Download
Critical
CVE-2026-1357
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
Critical
CVE-2026-23800
Modular DS 2.5.2 - Unauthenticated Privilege Escalation
Critical
CVE-2026-23550
Modular DS <= 2.5.1 - Unauthenticated Privilege Escalation
Medium
CVE-2026-27056
Solid Central – Site Management, Backups, Security, and Reporting <= 3.2.8 - Missing Authorization
Medium
CVE-2025-62992
Everest Backup <= 2.3.9 - Cross-Site Request Forgery
Critical
CVE-2025-14829
e-xact-hosted-payment <= 2.0 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-12934
Beaver Builder – WordPress Page Builder <= 2.9.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Update
Low
CVE-2025-12654
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.120 - Authenticated (Admin+) Arbitrary Directory Creation
Medium
CVE-2025-11759
Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()
Medium
CVE-2025-12887
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
Medium
CVE-2025-10304
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure
Medium
CVE-2025-12092
CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion
High
CVE-2025-12394
Backup Migration <= 1.4.9 - Information Exposure to Unauthenticated Back-up Download
Critical
CVE-2025-11833
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.