Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A vulnerability in HivePress allows unauthenticated attackers to inject malicious scripts through custom user attribute fields, which execute when users view affected profile pages.
The Listdom plugin for WordPress through version 6.1.2 allows authenticated administrators to delete arbitrary files on the server via path traversal in the 'ix[file]' parameter, potentially leading to remote code execution.
A stored DOM-based cross-site scripting vulnerability in the Molongui Authorship plugin allows unauthenticated attackers to inject arbitrary web scripts through comment href attributes, executing them when users visit affected pages.
FunnelKit for WordPress is vulnerable to unauthenticated stored cross-site scripting via checkout order fields. Attackers can inject arbitrary scripts that execute in the browser of users viewing affected pages.
A missing authorization check in AutomatorWP allows authenticated users with subscriber or higher permissions to view Fluent Forms records, exposing form IDs and titles.
A vulnerability in the Avada theme for WordPress allows authenticated users to store malicious scripts in author profile social links. If clicked when links do not open in a new window, the script executes in the victim's browser.
The WPAdverts plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting via the adverts_location parameter. Attackers can inject scripts that execute when users access affected pages.
A stored cross-site scripting vulnerability in the Retainful plugin for WordPress allows authenticated attackers with subscriber-level permissions to inject malicious scripts into web pages.
SureDash for WordPress is vulnerable to stored DOM-based cross-site scripting via image alt attributes in community posts, allowing authenticated users with subscriber privileges or higher to execute arbitrary scripts.
A vulnerability in the WPO365 Login plugin for WordPress allows unauthenticated attackers to inject malicious scripts via forged JWT claims in the id_token parameter, executing when an administrator visits the wizard page.
The Motors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the stm_f_s parameter. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts that execute when pages are viewed.
A vulnerability in WebToffee WooCommerce PDF Invoices through 5.0.2 allows unauthenticated attackers to view sensitive customer order documents if guest access is enabled and order details are known.
An authentication bypass flaw in the WordPress WPO365 | LOGIN plugin allows unauthenticated attackers holding a previously issued token to replay it and take over user accounts, including administrators, when a specific setting is enabled.
A reflected cross-site scripting vulnerability in WPForms allows unauthenticated attackers to execute scripts if a user clicks a malicious link under specific form description configurations.
WP Directory Kit for WordPress is vulnerable to second-order SQL injection through the display_name profile field. Authenticated users with subscriber-level privileges or higher can extract sensitive database information.
The Premium Packages plugin for WordPress is vulnerable to stored cross-site scripting via checkout billing parameters. Authenticated attackers with subscriber-level access can inject malicious scripts that execute in the context of users viewing the affected pages.
A critical vulnerability in the WPCOM Member plugin for WordPress allows unauthenticated attackers to bypass authentication and log in as any user, including administrators, if social login is configured.
An unauthenticated stored cross-site scripting vulnerability in the WP Photo Album Plus WordPress plugin allows remote attackers to inject arbitrary web scripts via the REQUEST_URI session history mechanism, executing whenever users view affected pages.
The Bookly plugin for WordPress is vulnerable to authenticated PHP Object Injection via deserialization in the value parameter. Attackers with custom-level permissions or above may inject PHP objects, though no exploit gadget chain is currently known.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.