Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filtersGroundhogg <= 3.7.3.3 - Reflected Cross-Site Scripting
Contact Form 7 Database – CFDB7 <= 1.0.0 - Authenticated (Administrator+) SQL Injection
Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection
WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Panorama – WordPress Project Management Plugin <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Top Comments <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Goodlayers Core <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Magazine Blocks <= 1.3.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
WPMasterToolKit <= 1.13.1 - Authenticated (Admin+) Arbitrary File Download
ACF City Selector <= 1.14.0 - Authenticated (Admin+) Arbitrary File Upload
GS Coaches <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
GeoDirectory <= 2.3.84 - Authenticated (Contributor+) Stored Cross-Site Scripting
ShopElement <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Nexter Blocks <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Arconix Shortcodes <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Floating Action Buttons <= 0.9.1 - Missing Authorization
AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress <= 9.11.0 - Reflected Cross-Site Scripting
Arconix Shortcodes <= 2.1.15 - Reflected Cross-Site Scripting
MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.8 - Missing Authorization
Event Espresso 4 Decaf <= 5.0.28.decaf - Cross-Site Request Forgery
Premium Blocks – Gutenberg Blocks for WordPress <= 2.1.42 - Authenticated (Contributor+) Stored Cross-Site Scripting
WPSSO Core <= 18.18.1 - Missing Authorization
WP Post Author <= 3.8.2 - Authenticated (Administrator+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.