High
CVE-2026-25951
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Critical
CVE-2026-25939
FUXA Unauthenticated Remote Arbitrary Scheduler Write
Critical
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
Medium
ghsa-8grv-jq2g-cfhw
amphp/http-server affected by HTTP/2 DDoS vulnerability
Medium
CVE-2026-25918
unity-cli Exposes Plaintext Credentials in Debug Logs (sign-package command)
High
CVE-2026-25892
Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint
Critical
CVE-2026-25881
@nyariv/sandboxjs has host prototype pollution from sandbox via array intermediary (sandbox escape)
Medium
CVE-2026-25878
FroshAdminer Adminer UI is accessible without admin session
Medium
CVE-2025-69389
Visitor Maps Extended Referer Field <= 1.2.6 - Reflected Cross-Site Scripting
Medium
b27c7002-985c-4de9-b46a-440adf2a1662
Sudoku Shortcode <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-1560
Custom Block Builder – Lazy Blocks <= 4.2.0 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2026-39613
Boutique <= 2.3.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25343
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-39614
JW Player for WordPress <= 2.3.8 - Missing Authorization
Medium
CVE-2026-15286
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
Medium
CVE-2026-25423
Real 3D FlipBook <= 4.19.1 - Missing Authorization
Medium
CVE-2025-69390
Business Template Blocks for WPBakery (Visual Composer) Page Builder <= 1.3.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-39616
Download Attachments <= 1.4.0 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-0910
wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-13391
Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) <= 4.9.60 - Missing Authorization to Unauthenticated Arbitrary Attachment and Dropbox File Deletion
High
CVE-2025-68552
WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-67998
Miraculous Elementor <= 2.0.7 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-32342
Quiz Maker <= 6.7.1.2 - Cross-Site Request Forgery
Medium
CVE-2026-39615
Download Manager <= 3.3.53 - Authenticated (Author+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.