Critical
CVE-2025-4318
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2026-18437
MailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates
Critical
CVE-2026-14483
Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Unauthenticated Arbitrary File Upload via 'files[file]' Parameter via Public I/O 'set_property' Command
High
CVE-2026-16236
Realtyna Organic IDX plugin + WPL Real Estate <= 5.3.0 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2026-54722
dssrf has an SSRF bypass with remove_at_symbol_in_string
Medium
CVE-2026-15255
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login < 6.0.9.4 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-14305
WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) < 1.10.2 - Missing Authorization
Medium
CVE-2026-14231
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 10.0.10 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-13145
WP Travel – Ultimate Travel Booking System, Tour Management Engine < 11.8.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Low
CVE-2026-16619
miniOrange 2FA <= 6.2.7 - Two-Factor Authentication Bypass via Brute Force
Medium
CVE-2026-15252
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization < 2.6.12 - Missing Authorization
Medium
CVE-2026-14923
Sync Post With Other Site < 1.9.3 - Missing Authorization
Medium
CVE-2026-14310
Tutor LMS – eLearning and online course solution < 4.0.0 - Missing Authorization
High
CVE-2026-16268
Newsletters <= 4.15 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2026-15054
Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder < 3.1.2 - Missing Authorization to Unauthenticated Unauthorized Form Submission
Medium
CVE-2026-16620
WPC Name Your Price for WooCommerce <= 2.2.4 - Unauthenticated Price Manipulation
Medium
CVE-2026-14223
Easy Appointments < 3.12.28 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-18436
MailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint
Critical
CVE-2026-16054
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.7 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-14222
Easy Appointments < 3.12.28 - Missing Authorization
Low
CVE-2026-16954
AI Engine <= 3.6.3 - Authenticated (Editor+) Information Exposure
Medium
CVE-2026-14547
Estatik Real Estate <= 4.3.2 - Unauthenticated Mail Relay
Medium
CVE-2026-14318
GiveWP – Donation Plugin and Fundraising Platform < 4.16.3 - Authenticated (Custom role+) Stored Cross-Site Scripting
Medium
CVE-2026-14207
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes <= 10.0.9 - Authenticated (Custom role+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.