High
CVE-2026-3090
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-2512
Code Embed <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
Medium
CVE-2026-2559
Post SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite
Medium
CVE-2026-42643
Image Widget <= 4.4.11 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2026-1463
Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery <= 4.0.4 - Authenticated (Author+) Local File Inclusion
Medium
CVE-2026-32586
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools < 7.11.3 - Missing Authorization
High
CVE-2026-25458
Moments <= 2.2 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25454
The League <= 4.4.1 - Missing Authorization
Medium
CVE-2026-25306
XStore Core <= 5.6.4 - Reflected Cross-Site Scripting
Medium
CVE-2026-25461
Listeo-Core - Directory Plugin by Purethemes <= 2.0.21 - Reflected Cross-Site Scripting
Medium
CVE-2026-2373
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure
High
CVE-2026-2579
WowStore – Store Builder & Product Blocks for WooCommerce <= 4.4.3 - Unauthenticated SQL Injection via 'search' Parameter
Medium
CVE-2025-53222
tagDiv Opt-In Builder <= 1.7.3 - Reflected Cross-Site Scripting
High
CVE-2026-25464
Jannah - Newspaper Magazine News BuddyPress AMP <= 7.6.4 - Unauthenticated Local File Inclusion
High
CVE-2026-24981
Visionary Core <= 1.4.9 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-25469
ViaBill – WooCommerce < 1.1.70 - Missing Authorization to Unauthenticated Settings Change
High
CVE-2026-27045
WooCommerce Infinite Scroll <= 1.6.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-32223
Tutor LMS – eLearning and online course solution <= 3.9.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-24359
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Missing Authorization
High
CVE-2026-24974
Support for CitiLights - Real Estate WordPress Theme <= 3.7.1 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-25001
Post Snippets – Custom WordPress Code Snippets Customizer <= 4.0.12 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-24977
Organici Library <= 2.1.2 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-27043
Photography <= 7.7.5 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2026-25369
Flexmls® IDX Plugin <= 3.15.9 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.