High
CVE-2026-5523
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 90
Reset filters
Medium
CVE-2026-57420
Author Box WP Lens <= 2.1.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Critical
CVE-2026-5524
Divi Form Builder <= 5.1.8 - Unauthenticated Arbitrary File Upload Leading to Remote Code Execution via 'acceptFileTypes' Parameter
High
CVE-2026-1829
Content Visibility for Divi Builder <= 4.02 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-9714
Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Critical
CVE-2026-5118
Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
Critical
CVE-2026-40769
Contact Form Extender for Divi – Submissions DB & Extra Fields <= 1.0.6 - Unauthenticated Arbitrary File Deletion
High
CVE-2026-6227
BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter
Critical
CVE-2026-3296
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
Medium
CVE-2026-4066
Smart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search
High
CVE-2026-2626
Divi Booster < 5.0.2 - Unauthenticated PHP Object Injection
High
CVE-2025-13062
Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass
High
CVE-2025-69059
DiveIt <= 1.4.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-12937
ACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update
Medium
CVE-2025-11922
Inactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-7825
Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation
Medium
CVE-2024-5647
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Magnific Popups JavaScript Library
Medium
CVE-2025-31540
ACME Divi Modules <= 1.3.5 - Missing Authorization
Medium
CVE-2025-22633
Give – Divi Donation Modules <= 2.0.0 - Sensitive Information Dislcosure
Medium
CVE-2025-0353
Divi Torque Lite <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-0350
Divi Carousel Lite <= 2.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Logo Carousel Widgets
Medium
CVE-2024-11337
Horoscope And Tarot <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-12024
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Unauthenticated Stored Cross-Site Scripting via Ticket Category and Ticket Type Name
Medium
CVE-2024-9386
Exclusive Divi – Divi Preloader, Modules for Divi & Extra Theme <= 1.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.