High
CVE-2026-9848
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2025-69131
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Download
High
CVE-2026-27429
Nifty <= 1.4.1 - Unauthenticated PHP Object Injection
High
CVE-2026-52706
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
High
CVE-2026-52707
Kastell <= 2.0 - Unauthenticated Local File Inclusion
Critical
CVE-2026-11976
MonsterInsights Pro 10.2.2, 10.2.0 - Unauthenticated Backdoor
High
CVE-2026-5776
Email Encoder – Protect Email Addresses and Phone Numbers < 2.4.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-11965
User Registration & Membership <= 5.1.0 - Unauthenticated Payment Bypass
High
CVE-2026-6381
WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters < 4.9.3 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2026-10750
Royal MCP <= 1.4.25 - Missing Authorization to Unauthenticated MCP Tool Use
High
CVE-2017-20250
Mac Photo Gallery <= 3.0 - Unauthenticated Arbitrary File Deletion
High
CVE-2017-20248
Apptha Slider Gallery <= 1.0 - Unauthenticated Arbitrary File Download
Medium
CVE-2026-4058
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation
High
CVE-2026-8365
Blocksy <= 2.1.41 - Authenticated (Contributor+) PHP Object Injection via Deserialization of Untrusted Data via 'blocksy_meta' REST API Field
Medium
CVE-2026-8677
Prime Elementor Addons <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget HTML Tag Settings
Medium
CVE-2026-8599
MailerPress <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via Campaign HTML Content Field
Medium
CVE-2026-7542
Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure
Medium
CVE-2026-10553
jQuery Hover Footnotes <= 1.4 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-10738
jQuery Hover Footnotes <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via Footnote Qualifier ('{{...}}' Syntax)
High
CVE-2026-9662
Recover Exit For WooCommerce <= 1.0.3 - Unauthenticated Local File Inclusion via 'tpf' Parameter
High
CVE-2026-9185
6Storage Rentals <= 2.26.0 - Unauthenticated Insecure Direct Object Reference to Arbitrary User Disclosure and Modification via 'userId' Parameter
Medium
CVE-2026-8909
WpMobi <= 0.0.3 - Cross-Site Request Forgery via save_general_settings Action
Medium
CVE-2026-8902
AJAX Report Comments <= 2.0.4 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-8499
Helpfulcrowd Product Reviews <= 1.2.9 - Inccorect Authorization via Type Juggling in 'token' Parameter to Arbitrary Settings Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.