High
CVE-2026-24956
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,073
Reset filters
Medium
CVE-2026-1215
MMA Call Tracking <= 2.3.15 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-13431
SlimStat Analytics <= 5.3.1 - Authenticated (Subscriber+) SQL Injection via `args` Parameter
High
CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Medium
CVE-2026-31922
Fox LMS <= 1.0.6.3 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-24962
Sigmize <= 0.0.9 - Cross-Site Request Forgery
Medium
CVE-2025-15477
The Bucketlister <= 0.1.5 - Authenticated (Contributor+) SQL Injection via `category` and `id` Shortcode Attributes
Medium
CVE-2026-1611
Wikiloops Track Player <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-31917
ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection
High
CVE-2025-13192
Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints
Medium
CVE-2026-0816
All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
High
CVE-2025-15268
Infility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass
Medium
CVE-2025-15482
Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-15508
Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-15507
Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification
Medium
CVE-2026-1370
SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter
Medium
CVE-2026-25023
Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 - Unauthenticated Information Exposure
Medium
CVE-2026-25024
ThirstyAffiliates <= 3.11.9 - Cross-Site Request Forgery
Medium
CVE-2026-25022
KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection
Medium
CVE-2026-25325
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure
Medium
CVE-2026-39602
Order Tracking <= 3.4.4 - Missing Authorization
Medium
CVE-2026-0683
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
High
CVE-2025-69365
Uroan Core <= 1.4.4 - Unauthenticated SQL Injection
High
CVE-2025-69309
Saasplate Core <= 1.2.8 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.