High
CVE-2026-22354
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2025-68541
Ippsum <= 1.2.0 - Unauthenticated PHP Object Injection
High
CVE-2026-32355
JetEngine < 3.8.4.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-2312
Media Library Folders <= 8.3.6 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename
High
CVE-2026-2144
Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage
High
CVE-2025-15157
Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
High
CVE-2025-69405
Lorem Ipsum | Books & Media Store <= 1.2.6 - Unauthenticated PHP Object Injection
High
CVE-2025-68526
Modal Popup Box <= 1.6.1 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2025-69404
Extreme Store <= 1.5.7 - Unauthenticated PHP Object Injection
High
CVE-2026-22344
FiveStar <= 1.7 - Unauthenticated Local File Inclusion
High
CVE-2025-69329
Prestige < 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-22345
Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery <= 1.6.0 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-22346
Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.5.4 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-2295
WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more
High
CVE-2026-0910
wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
High
CVE-2025-67995
PatioTime < 2.1 - Unauthenticated PHP Object Injection
High
CVE-2025-67997
Travelicious < 1.6.7 - Unauthenticated PHP Object Injection
Medium
CVE-2025-67993
Atarim <= 4.2.1 - Missing Authorization
High
CVE-2025-67996
Nestin < 1.2.6 - Unauthenticated PHP Object Injection
High
CVE-2025-69382
Themesflat Elementor <= 1.0.1 - Unauthenticated PHP Object Injection
High
CVE-2025-69328
Booking and Rental Manager <= 2.5.9 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-31918
immonex Kickstart <= 1.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-67990
GMap Targeting <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.