Medium
CVE-2026-39475
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
Medium
CVE-2026-25378
Nelio AB Testing <= 8.2.4 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-0722
Shield Security <= 21.0.8 - Cross-Site Request Forgery to SQL Injection
High
CVE-2026-2232
Product Table and List Builder for WooCommerce Lite <= 4.6.2 - Unauthenticated Time-Based SQL Injection via 'search' Parameter
Medium
CVE-2026-1219
MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar 4.0 - 5.10 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Exposure
High
CVE-2025-12707
Library Management System <= 3.2.1 - Unauthenticated SQL Injection
High
CVE-2026-1581
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
Medium
CVE-2026-32372
ShopBuilder – Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure
High
CVE-2026-2495
WPNakama <= 0.6.5 - Unauthenticated SQL Injection via 'order' REST API Parameter
Medium
CVE-2026-1639
Taskbuilder <= 5.0.2 - Authenticated (Subscriber+) SQL Injection via 'order' and 'sort_by' Parameters
Medium
CVE-2025-12074
Context Blog <= 1.2.5 - Unauthenticated Private Post Disclosure
High
CVE-2026-2576
Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter
Medium
CVE-2026-1317
WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name
Medium
CVE-2026-3075
Simple Ajax Chat <= 20251121 - Unauthenticated Information Exposure
Medium
CVE-2025-15489
Passster <= 4.2.23 - Unauthenticated Protected Content Disclosure
High
CVE-2025-69337
Wolmart Core <= 1.9.6 - Unauthenticated SQL Injection
Medium
CVE-2025-8781
Bookster – WordPress Appointment Booking Plugin <= 2.1.1 - Authenticated (Administrator+) SQL Injection via 'raw'
Medium
CVE-2026-32366
Collapsing Categories <= 3.0.9 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-32368
Geo to Lat <= 1.0.19 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-32365
Collapsing Archives <= 3.0.7 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-32358
Booking Calendar <= 10.14.15 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-32354
WpEvently < 5.1.9 - Unauthenticated Information Exposure
High
CVE-2026-2024
PhotoStack Gallery <= 0.4.1 - Unauthenticated SQL Injection via 'postid' Parameter
Medium
CVE-2026-24959
JS Help Desk <= 3.0.1 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.