Medium
CVE-2026-39588
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Medium
CVE-2026-32377
Pranayama Yoga <= 1.2.2 - Missing Authorization
Medium
CVE-2026-32376
Kalon <= 1.2.9 - Missing Authorization
Medium
CVE-2026-0549
Groups <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'groups_group_info' Shortcode
Medium
CVE-2026-25375
Image Photo Gallery Final Tiles Grid <= 3.6.10 - Missing Authorization
Medium
CVE-2025-13738
Easy Table of Contents <= 2.0.78 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-12707
Library Management System <= 3.2.1 - Unauthenticated SQL Injection
Medium
CVE-2026-32381
App Landing Page <= 1.2.2 - Missing Authorization
Medium
CVE-2026-32371
Elegant Pink <= 1.3.3 - Missing Authorization
Medium
CVE-2026-32385
RegistrationMagic <= 6.0.7.6 - Missing Authorization
Medium
CVE-2025-13842
Breadcrumb NavXT <= 7.5.0 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-13079
Popup Builder - Create highly converting, mobile friendly marketing popups. <= 4.4.2 - Improper Authorization to Unauthenticated Subscriber Removal via Predictable Tokens
Medium
CVE-2026-32379
Rara Academic <= 1.2.2 - Missing Authorization
Medium
CVE-2026-23541
Mail Mint <= 1.19.4 - Missing Authorization
Medium
CVE-2026-1461
Simple Membership <= 4.7.0 - Unauthenticated Improper Handling of Missing Values
High
CVE-2026-1581
wpForo Forum <= 2.4.14 - Unauthenticated Time-Based SQL Injection
Medium
CVE-2025-13612
Album and Image Gallery Plus Lightbox <= 2.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Medium
CVE-2026-39669
NitroPack <= 1.19.3 - Missing Authorization
Medium
CVE-2025-12448
Smartsupp – live chat, AI shopping assistant and chatbots <= 3.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-32375
Travel Diaries <= 1.2.4 - Missing Authorization
High
CVE-2026-23549
WpEvently <= 5.1.1 - Unauthenticated PHP Object Injection
High
CVE-2025-15041
BackWPup 5.0.0 - 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update
Medium
CVE-2026-32383
Ridhi <= 1.1.2 - Missing Authorization
Medium
CVE-2025-12027
Mesmerize Companion <= 1.6.158 - Missing Authorization Authenticated (Subscriber+) Settings Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.