Critical
CVE-2026-1969
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2025-12886
Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery via route_path
High
CVE-2026-4248
Ultimate Member <= 2.11.2 - Authenticated (Contributor+) Sensitive Information Exposure to Account Takeover via Shortcode Template Tag
High
CVE-2026-32505
Kiddy <= 2.0.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-3098
Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll
Medium
CVE-2026-4281
FormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow
High
CVE-2026-4758
WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field
Critical
CVE-2026-4001
Woocommerce Custom Product Addons Pro <= 5.4.1 - Unauthenticated Remote Code Execution via Custom Pricing Formula
High
CVE-2026-3533
JupiterX Core <= 4.14.1 - Authenticated (Subscriber+) Missing Authorization To Limited File Upload via Popup Template Import
High
CVE-2026-32573
Nelio A/B Testing – AB Tests and Heatmaps for Better Conversion Optimization <= 8.2.7 - Authenticated (Editor+) Remote Code Execution
High
CVE-2026-32482
Ona < 1.24 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-25366
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.1 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-32567
YML for Yandex Market < 5.3.0 - Authenticated (Shop Manager+) Arbitrary File Deletion
High
CVE-2026-25413
WPBookit Pro <= 1.6.18 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-25017
NaturaLife Extensions <= 2.1 - Unauthenticated Local File Inclusion
Critical
CVE-2026-32488
User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder <= 4.4.9 - Unauthenticated Remote Code Execution
High
CVE-2026-25328
Product File Upload for WooCommerce <= 2.2.4 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-25345
Mixed Media Gallery Blocks <= 3.3.2 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2026-32525
JetFormBuilder — Dynamic Blocks Form Builder <= 3.5.6.1 - Authenticated (Contributor+) Remote Code Execution
High
CVE-2025-10679
ReviewX – WooCommerce Product Reviews with Multi-Criteria, Reminder Emails, Google Reviews, Schema & More <= 2.2.12 - Unauthenticated Limited Remote Code Execution
High
CVE-2026-4314
The Ultimate WordPress Toolkit – WP Extended <= 3.2.4 - Authenticated (Subscriber+) Privilege Escalation via Menu Editor Module
High
CVE-2025-14037
Invelity Products Feeds <= 1.2.6 - Cross-Site Request Forgery to Arbitrary File Deletion
Low
CVE-2026-2290
Post Affiliate Pro <= 1.29.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field
Medium
CVE-2026-1647
Comment Genius <= 1.2.5 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.