High
CVE-2025-15268
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-15508
Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14461
Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid
High
CVE-2025-15285
SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification
High
CVE-2025-69372
SevenHills <= 1.6.2 - Unauthenticated PHP Object Injection
Medium
CVE-2026-24941
WP Job Portal <= 2.4.4 - Missing Authorization
Medium
CVE-2025-22657
Atarim <= 4.0.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Medium
CVE-2026-24944
Subscribe2 <= 10.44 - Missing Authorization
Medium
CVE-2026-1371
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
High
CVE-2026-1065
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via SVG file
Medium
CVE-2026-1447
Mail Mint <= 1.19.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2026-0950
Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data
High
CVE-2026-39538
Mikado Core <= 1.6 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-25326
CMSMasters Content Composer <= 1.4.5 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-23978
Gyan Elements <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-1431
Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
Medium
CVE-2025-15510
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-25391
WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 - Missing Authorization
Medium
CVE-2026-0683
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
Medium
CVE-2026-25019
Atarim <= 4.3.1 - Missing Authorization
Medium
CVE-2026-25321
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Missing Authorization
High
CVE-2025-69371
KindlyCare <= 1.6.1 - Unauthenticated PHP Object Injection
Medium
CVE-2026-25402
Echo Knowledge Base – Documentation, FAQs, AI Chat & AI Search <= 16.011.0 - Missing Authorization
High
CVE-2025-69370
Capella <= 2.5.5 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.