High
CVE-2025-15285
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-1370
SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter
Medium
CVE-2026-0681
Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
High
CVE-2026-1756
WP FOFT Loader <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2026-1755
Menu Icons by ThemeIsle <= 0.13.20 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2025-69372
SevenHills <= 1.6.2 - Unauthenticated PHP Object Injection
Medium
CVE-2026-24941
WP Job Portal <= 2.4.4 - Missing Authorization
High
CVE-2025-15386
Responsive Lightbox & Gallery < 2.6.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24943
Grand Conference <= 5.3.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-39605
Super Custom Login <= 1.1 - Missing Authorization
Medium
CVE-2026-24946
Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Missing Authorization
High
CVE-2026-24949
PhotoMe <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-67624
Optimize More! – Images <= 1.1.3 - Missing Authorization
Medium
CVE-2026-24950
Authorsy <= 1.0.6 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-22657
Atarim <= 4.0.9 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Medium
CVE-2026-24944
Subscribe2 <= 10.44 - Missing Authorization
Medium
CVE-2026-24948
Reflector <= 1.2.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-31916
Latest Post Shortcode <= 14.2.1 - Missing Authorization
Medium
CVE-2026-39606
BizReview <= 1.5.14 - Missing Authorization
High
CVE-2026-1730
OS DataHub Maps <= 1.8.3 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2026-1371
Tutor LMS <= 3.9.5 - Authenticated (Subscriber+) Information Disclosure in Coupon Details via 'tutor_coupon_details' AJAX Action
High
CVE-2026-1375
Tutor LMS <= 3.9.5 - Insecure Direct Object Reference to Authenticated (Instructor+) Arbitrary Course Modification and Deletion
High
CVE-2026-0617
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-1058
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.