Medium
CVE-2026-28173
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-28157
Do Lasso <= 358 - Authenticated (Subscriber+) Path Traversal
Medium
CVE-2026-73401
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.3.7 - Missing Authorization
Medium
CVE-2026-18216
Backup Migration <= 2.1.6 - Authenticated (Administrator+) Privilege Escalation
Medium
CVE-2026-12976
LearnPress – WordPress LMS Plugin for Create and Sell Online Courses < 4.4.4 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-14922
WP Photo Album Plus < 9.2.04.003 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-16541
Simply Schedule Appointments <= 1.6.12.16 - Authenticated (Team Member+) Information Exposure
Medium
CVE-2026-28181
AcyMailing SMTP Newsletter <= 10.11.1 - Missing Authorization
High
CVE-2026-61974
Mang Board WP <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-28189
Participants Database <= 2.7.8.4 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-14239
Tour Master - Tour Booking, Travel, Hotel < 5.4.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28170
Blog Floating Button <= 1.4.20 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-28191
The Grid <= 2.7.9.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-16611
Product Feed PRO for WooCommerce <= 13.5.6 - Unauthenticated Information Exposure
Medium
CVE-2026-28186
Travelfic Toolkit <= 1.5.1 - Missing Authorization
High
CVE-2026-28176
Booking Activities <= 1.18.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-28156
Do Lasso <= 358 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-28168
CubeWP <= 1.1.30 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-10308
Astro Booking Engine <= 1.4.0 - Cross-Site Request Forgery to Settings Reset
Medium
CVE-2026-13168
Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce < 4.1.20 - Authenticated (Contributor+) Information Exposure
High
CVE-2026-28161
Service Finder Bookings <= 6.2 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-18807
ECS <= 4.3.7 - Missing Authorization
High
CVE-2026-28158
Do Lasso <= 358 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-13612
KiviCare – Clinic & Patient Management System (EHR) < 4.5.2 - Authenticated (Custom role+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.