tainacan has 3 CVEs on record. 3 were published in the last 90 days. The median CVSS is 6.5 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
CVE-2026-95590High· 7.1Subscriber SQL Injection in Tainacan <= 1.2.0 versions.39CVE-2026-93767Medium· 6.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter36CVE-2026-104743Medium· 4.9Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment27
tainacan vulnerabilities
CVEs affecting tainacan, newest first. Open any entry for full detail, references, and exploit status.
3 CVEsRSS
CVE-2026-104743Medium· 4.9Tainacan <= 1.3.0 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'tmp_file' Parameter via Mass Assignment
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and a…
CVE-2026-93767Medium· 6.5The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and a…
CVE-2026-95590High· 7.1Subscriber SQL Injection in Tainacan <= 1.2.0 versions.
Subscriber SQL Injection in Tainacan <= 1.2.0 versions.