High
CVE-2025-69373
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2026-24988
The Events Calendar Shortcode & Block <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-68853
Contact Manager <= 9.1 - Unauthenticated PHP Object Injection
High
CVE-2025-67981
Besa <= 2.3.15 - Unauthenticated Local File Inclusion
High
CVE-2026-25027
Unicamp <= 2.7.1 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-69324
NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-67980
Hara <= 1.2.17 - Unauthenticated Local File Inclusion
High
CVE-2025-67984
NPS computy <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-67979
WPForms Google Sheet Connector <= 4.0.1 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-23976
Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-68037
Export Media URLs <= 2.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-25597
PrestaShop affected by time based enumeration in FO login form
Medium
CVE-2026-25155
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)
Low
CVE-2026-25149
Qwik City Open Redirect via fixTrailingSlash
Medium
CVE-2026-25151
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Critical
CVE-2026-25150
Prototype Pollution via FormData Processing in Qwik City
Medium
CVE-2026-25148
Qwik SSR XSS via Unsafe Virtual Node Serialization
High
CVE-2025-15368
SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Medium
CVE-2026-0679
Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint
Medium
CVE-2025-15487
Code Explorer <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter
Medium
CVE-2025-15260
MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
Medium
CVE-2026-0816
All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
High
CVE-2025-15268
Infility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass
Medium
CVE-2026-0742
Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.