Tainacan
Tainacan has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 17 are fixed as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 4 high. 2024 was the busiest year with 8 disclosures.
The most common weakness is Cross-Site Scripting, behind 7 of the records (41%). Other recurring categories include SQL Injection, Missing Authorization.
Every one of the 17 issues recorded for Tainacan has a vendor fix available, so running the current release closes all known holes.
11 independent researchers contributed these findings, most of them (3) reported by Deadbee. Tainacan is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2026-6230Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter
Read the full analysisVulnerability Records

Tainacan
Author
tainacan
Tainacan is an open-source repository platform that turns WordPress into a powerful and flexible environment for managing and publishing digital collections — as easily as writing a blog post. Designed for cultural institutions, research projects, archives, museums, and any kind of digital collection, Tainacan integrates seamlessly with the WordPress block editor and takes full advantage of its ecosystem. Key Features: Free and open source – Licensed under GPLv3: use, modify, and share freely WordPress based – Built to last taking advantage of the power of the WordPress ecosystem and features Compatible with any theme – Use the Tainacan Interface theme or adapt any WordPress theme Easy management – Create collections, define metadata, manage users, and publish content effortlessly Highly customizable – Configure metadata, taxonomies, and filters to match your project’s needs Faceted search – Offer advanced browsing with intuitive custom filters Importing and exporting – Import bulk data from spreadsheets, export in CSV, XLSX, JSON, and other formats API and interoperability – Complete RESTful API with support for metadata mapping to standards such as Dublin Core Gutenberg blocks – Tell stories about your digital archive using a variety of blocks anywhere in your site Support Need help? Find documentation, community support, and development resources at: Website: https://tainacan.org/ Documentation Wiki: https://wiki.tainacan.org/ GitHub: https://github.com/tainacan/tainacan User Forum: https://tainacan.discourse.group/
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C