High
CVE-2026-46697
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2026-27400
BookPro <= 1.1.0 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-69129
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Upload
High
CVE-2026-52707
Kastell <= 2.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-9067
Schema & Structured Data for WP & AMP < 1.60 - Unauthenticated Arbitrary Media Upload
Medium
CVE-2026-11965
User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass
High
CVE-2026-6381
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-60218
PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2017-20250
Mac Photo Gallery <= 3.0 - Unauthenticated Arbitrary File Deletion
High
CVE-2017-20248
Apptha Slider Gallery <= 1.0 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-7542
Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure
High
CVE-2026-49061
WPC Product Options for WooCommerce <= 3.2.1 - Unauthenticated Arbitrary File Download
Critical
CVE-2024-58348
Background Image Cropper <= 1.2 - Unauthenticated Remote Code Execution
Medium
CVE-2026-9197
Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
Medium
CVE-2026-2500
Quick Playground <= 1.3.4 - Authenticated (Administrator+) Arbitrary File Read via 'filename' Parameter
Medium
CVE-2026-7565
LearnPress <= 4.1.4 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'import-user-file' Parameter
High
CVE-2026-8438
All-In-One Security (AIOS) <= 5.4.7 - Unauthenticated Stored Cross-Site Scripting via REST API Request Path
Low
CVE-2025-12656
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.128 - Authenticated (Admin+) Arbitrary Directory Deletion
High
CVE-2026-5411
WP Captcha PRO <= 5.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-49766
WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-8608
Event Monster <= 2.1.0 - Unauthenticated Insufficient Verification of Data Authenticity to Payment Bypass via em_capture_payment AJAX Action
Medium
CVE-2019-25727
10WebAdManager <= 1.0.11 - Unauthenticated Arbitrary File Download
High
CVE-2026-9290
WP User Manager <= 2.9.17 - Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
High
CVE-2026-7654
Admin Columns <= 7.0.18 - Authenticated (Contributor+) PHP Object Injection to Remote Code Execution via Custom Field Meta Value
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.