Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filtersWordPress Gallery Plugin – Limb Image Gallery <= 1.5.7 - Authenticated (Subscriber+) Arbitrary File Upload
My Favorites <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Smart Blocks <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Arkhe Blocks <= 2.23.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Linked Variation for WooCommerce <= 1.0.5 - Cross-Site Request Forgery
my flatonica <= 0.0.8 & my wooden under construction <= 2.0.7 - Reflected Cross-Site Scripting
ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection
Contact Form by Supsystic <= 1.7.28 - Authenticated (Admin+) Remote Code Execution
Happy Addons for Elementor <= 3.12.3 - Missing Authorization
ShortPixel Image Optimizer <= 5.6.3 - Missing Authorization
Boost Your Blog's Engagement with WP Post Author <= 3.8.1 - Authenticated (Administrator+) SQL Injection
TablePress <= 2.4.2 - Authenticated (Author+) Stored Cross-Site Scripting
Stackable – Page Builder Gutenberg Blocks <= 3.13.6 - Unauthenticated CSS Injection
Category Icon <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Order Attachments for WooCommerce 2.0 - 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary File Upload
ImagePress - Image Gallery <= 1.2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
2D Tag Cloud <= 6.0.2 - Reflected Cross-Site Scripting via add_query_arg Parameter
Mynx Page Builder <= 0.27.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Read more By Adam <= 1.1.8 - Missing Authorization to Authenticated (Subscriber+) Read More Button Deletion
Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass
Bridge Core <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Demo Import
Rescue Shortcodes <= 2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Elementor Addon Elements <= 1.13.8 - Authenticated (Contributor+) Sensitive Information Exposure via table_saved_sections
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.