High
CVE-2026-1581
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-13612
Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Medium
CVE-2026-39669
NitroPack <= 1.19.3 - Missing Authorization
Medium
CVE-2025-12448
Smartsupp – live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-32375
Travel Diaries <= 1.2.4 - Missing Authorization
High
CVE-2026-23549
WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection
High
CVE-2025-15041
BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update
Medium
CVE-2026-32383
Ridhi <= 1.1.2 - Missing Authorization
Medium
CVE-2025-12027
Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update
High
CVE-2026-23542
Grand Restaurant <= 7.0.10 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39535
Display Eventbrite Events <= 6.5.6 - Missing Authorization
Medium
CVE-2026-25374
Spa and Salon <= 1.3.2 - Missing Authorization
Medium
CVE-2026-32378
Book Landing Page <= 1.2.7 - Missing Authorization
Medium
CVE-2026-32386
Envo Extra <= 1.9.13 - Missing Authorization
Medium
CVE-2026-39667
Korea SNS <= 1.7.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-14294
Razorpay for WooCommerce <= 4.7.8 - Missing Authentication to Unauthenticated Order Modification
Medium
CVE-2026-32382
Digital Download <= 1.1.4 - Missing Authorization
Medium
CVE-2025-13732
s2Member <= 251005 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-32372
ShopBuilder – Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure
Medium
CVE-2026-39664
Leadrebel <= 1.0.2 - Missing Authorization
Medium
CVE-2026-39668
Book Previewer for Woocommerce <= 1.0.6 - Missing Authorization
High
CVE-2026-32384
WpBookingly <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
Low
ghsa-chm2-m3w2-wcxm
OpenClaw Google Chat spoofing access with allowlist authorized mutable email principal despite sender-ID mismatch
Medium
CVE-2026-2426
WP-DownloadManager <= 1.69 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'file' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.