Critical
CVE-2026-12375
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-12115
Counter Box <= 2.0.13 - Authenticated (Administrator+) PHP Object Injection via Import
Medium
CVE-2026-12685
EscortWP <= 3.6.2 - Backdoored Software
Medium
CVE-2026-2381
WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
High
CVE-2026-8176
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
High
CVE-2026-8442
WP Review Slider Pro <= 12.6.8 - Authenticated (Subscriber+) Arbitrary File Deletion via 'myaction' Parameter
High
CVE-2026-6933
Premmerce Dev Tools <= 2.0 - Missing Authorization to Authenticated (Subscriber+) Remote Code Execution via Plugin Creation
Medium
CVE-2026-6964
Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action
High
CVE-2016-20077
Photocart Link <= 1.6 - Unauthenticated Local File Inclusion
High
CVE-2016-20080
Brandfolder – Digital Asset Management Simplified. <= 3.0 - Unauthenticated Local File Inclusion
High
CVE-2024-6228
WANotifier <= 2.5 - Unauthenticated Local File Inclusion
Critical
CVE-2026-52705
Sigma Forms Pro <= 1.4.5 - Unauthenticated Arbitrary File Upload
High
CVE-2026-54194
Avada (Fusion) Builder <= 3.15.4 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-12256
Avada <= 3.15.3 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-68045
Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) <= 4.1.12 - Missing Authorization
High
CVE-2026-11962
FileOrganizer <= 1.1.0 - Authenticated (Authenticated+) Local File Inclusion
High
CVE-2016-20078
IMDB Profile Widget <= 1.0.8 - Unauthenticated Local File Inclusion
High
CVE-2016-20076
Simple-Backup <= 2.7.11 - Unauthenticated Arbitrary File Download
High
CVE-2016-20079
Dharma Booking <= 2.28.3 - Unauthenticated Local File Inclusion
High
CVE-2016-20081
HB Audio Gallery Lite <= 1.0.0 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-54197
GetGenie – AI Content Writer with Keyword Research & SEO Tracking <= 4.4.1 - Unauthenticated Information Exposure
Medium
CVE-2026-2470
Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'
Medium
CVE-2026-9134
Photo Gallery by FooGallery : Responsive Image Gallery, Masonry Gallery & Carousel <= 3.1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_attribute_key' Shortcode Parameter
High
CVE-2026-9109
GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.