Critical
CVE-2025-26900
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2025-26885
Assistant <= 1.5.1 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2024-13798
Post Grid and Gutenberg Blocks – ComboBlocks <= 2.3.5 - Unauthenticated Paid Order Creation
High
CVE-2024-13899
Mambo Importer <= 1.0 - Authenticated (Administrator+) PHP Object Injection
Critical
CVE-2025-27286
Saoshyant Slider <= 3.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-27299
MyTicket Events <= 1.2.4 - Unauthenticated Limited File Read
Critical
CVE-2025-27287
SS Quiz <= 2.0.5 - Unauthenticated PHP Object Injection
Medium
CVE-2024-13873
WP Job Portal <= 2.2.8 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection
High
CVE-2025-27264
Doctor Appointment Booking <= 1.0.0 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2025-27354
Simple Email Subscriber <= 2.3 - Reflected Cross-Site Scripting
Critical
CVE-2025-27270
Residential Address Detection <= 2.5.4 - Unauthenticated Arbitrary Options Update
Medium
CVE-2025-27283
Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Download
High
CVE-2024-13353
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-13537
C9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-13818
Registration Forms – User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction <= 3.8.4 - Sensitive Information Exposure via Log Files
High
CVE-2024-13753
Ultimate Classified Listings <= 1.5 - Cross-Site Request Forgery to Account Takeover
Critical
CVE-2024-13789
Ravpage <= 2.31 - PHP Object Injection
High
CVE-2025-0916
YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-13339
DeBounce Email Validator <= 5.8.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2024-13592
Team Builder For WPBakery Page Builder(Formerly Visual Composer) <= 1.0 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-13719
PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
High
CVE-2024-11582
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter
High
CVE-2025-27015
Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Unauthenticated Local File Inclusion
High
CVE-2024-13483
LTL Freight Quotes – SAIA Edition <= 2.2.10 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.