High
7bbead7c-47b9-473f-b335-6fae4b5998d6
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2026-6020
ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API
Medium
CVE-2026-11454
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5.2 - Insecure Direct Object Reference
Medium
CVE-2026-7105
Xpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function
Medium
CVE-2026-15281
User Access Manager <= 2.3.12 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-7456
Udimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action
High
CVE-2026-18881
TableOn <= 1.0.5.1 - Unauthenticated Blind SQL Injection via 'comment_count' Filter Parameter
Critical
CVE-2026-5581
Multi Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion
High
CVE-2026-6079
Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
Medium
CVE-2026-17532
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
Medium
CVE-2026-17505
TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting
High
CVE-2026-6147
LightSync Pro <= 2.1.6 - Authenticated (Author+) Arbitrary File Upload
High
CVE-2026-12000
Page and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API
High
CVE-2026-6627
WPFormify <= 1.1.1 - Missing Authorization
Medium
CVE-2026-6972
SKT Skill Bar <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-7693
Backup Migration <= 2.1.5.1 - Authenticated (Administrator+) OS Command Injection via 'file' Parameter
Medium
CVE-2026-5116
Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-7726
Layouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action
High
CVE-2026-7444
Search Analytics for WP <= 1.4.16 - Cross-Site Request Forgery
Medium
CVE-2026-7441
Simple Yearly Archive <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-5651
Askeet <= 3.0 - Authenticated (Administrator+) SQL Injection via 'sql_query' Parameter
Medium
CVE-2026-5108
Super Progressive Web Apps <= 2.2.43 - Authenticated (Administrator+) Stored Cross-Site Scripting via Offline Message Setting
High
CVE-2026-6639
AI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure
High
CVE-2026-7529
wiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.