High
CVE-2025-15672
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2026-65572
A.Williams <= 1.3.1 - Unauthenticated PHP Object Injection
High
CVE-2026-65578
Agora — Event & Conference WordPress Theme <= 1.9 - Unauthenticated PHP Object Injection
High
CVE-2026-65574
Abogado - Lawyer WordPress Theme <= 1.18 - Unauthenticated PHP Object Injection
Medium
CVE-2026-18470
Login & Register Forms <= 4.0.1 - Unauthenticated Registered User Email Address Disclosure
High
CVE-2026-65556
WPBruiser {no- Captcha anti-Spam} <= 3.1.43 - Unauthenticated PHP Object Injection
Medium
CVE-2026-11977
WP Post Author <= 3.9.1 - Authenticated (Author+) SQL Injection
High
CVE-2026-6079
Material Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion
Medium
CVE-2026-8790
Football Pool <= 2.13.4 - Authenticated (Subscriber+) Reflected Cross-Site Scripting
High
CVE-2026-8761
Dokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation
High
CVE-2026-27096
ColorFolio - Freelance Designer WordPress <= 1.3 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-12720
Kirki – Freeform Page Builder, Website Builder & Customizer < 6.0.13 - Unauthenticated PHP Object Injection
High
CVE-2026-28139
Ajax Search Lite – Live Search & Filter <= 4.14.4 - Unauthenticated PHP Object Injection
High
CVE-2026-16267
Newsletters <= 4.15 - Unauthenticated PHP Object Injection
High
CVE-2026-16258
Ajax Search Lite <= 4.14.4 - Unauthenticated PHP Object Injection
High
CVE-2026-14602
Remote API <= 0.2 - Unauthenticated PHP Object Injection
Medium
CVE-2026-15151
Five Star Restaurant Reservations – WordPress Booking Plugin < 2.7.23 - Missing Authorization
High
CVE-2026-16062
Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar < 5.3.7 - Authenticated (Contributor+) PHP Object Injection
Critical
CVE-2026-8457
WooCommerce - Social Login <= 2.8.7 - Unauthenticated Authentication Bypass via Forged Apple 'id_token' JWT
High
CVE-2026-15450
NEX-Forms <= 9.2.3 - Authenticated (Admin+) Arbitrary File Deletion via Path Traversal via 'location' Parameter
High
CVE-2026-16144
Kali Forms <= 2.4.20 - Unauthenticated Remote Code Execution via 'thisPermalink' Field Parameter
Medium
CVE-2026-12938
Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
High
CVE-2026-65552
Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-65549
Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress <= 3.2.10 - Authenticated (Author+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.