Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates
Contact Form to Any API <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.6 - Missing Authorization
EmallShop <= 2.4.21 - Unauthenticated PHP Object Injection
Bookit — Booking & Appointment Calendar <= 2.5.1 - Missing Authorization
Avada < 7.13.2 - Cross-Site Request Forgery
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization
PressMart <= 1.2.26 - Unauthenticated PHP Object Injection
Blocksy Companion Pro <= 2.1.37 - Authenticated (Contributor+) Remote Code Execution
WPAdverts – Classifieds Plugin <= 2.3.0 - Missing Authorization
Alukas < 3.0.0 - Unauthenticated PHP Object Injection
Link Library <= 7.8.8 - Authenticated (Contributor+) Arbitrary File Deletion
Feed KuantoKusta for WooCommerce – Free <= 5.3 - Unauthenticated SQL Injection
Kapee < 1.7.0 - Unauthenticated PHP Object Injection
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.7.3 - Missing Authorization
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Bagisto affected by Cross-site Scripting
Bagisto affected by Server-Side Request Forgery
Astro: XSS in define:vars via incomplete </script> tag sanitization
Gutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes
Gallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute
Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.