High
CVE-2025-67984
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2025-67979
WPForms Google Sheet Connector <= 4.0.1 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-23976
Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-68037
Export Media URLs <= 2.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-25597
PrestaShop affected by time based enumeration in FO login form
Medium
CVE-2026-25155
Qwik City CSRF protection middleware does not work properly for content type header with parameters (eg. multipart/form-data)
Low
CVE-2026-25149
Qwik City Open Redirect via fixTrailingSlash
Medium
CVE-2026-25151
Qwik City has a CSRF Protection Bypass via Content-Type Header Validation
Critical
CVE-2026-25150
Prototype Pollution via FormData Processing in Qwik City
Medium
CVE-2026-25148
Qwik SSR XSS via Unsafe Virtual Node Serialization
High
CVE-2025-15368
SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Medium
CVE-2026-0679
Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint
Medium
CVE-2025-15487
Code Explorer <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter
Medium
CVE-2025-15260
MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
Medium
CVE-2026-0816
All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
High
CVE-2025-15268
Infility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass
Medium
CVE-2026-0742
Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action
High
CVE-2026-25547
@isaacs/brace-expansion has Uncontrolled Resource Consumption
Medium
CVE-2026-0743
WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter
High
CVE-2026-24887
Claude Code has a Command Injection in find Command Bypasses User Approval Prompt
Medium
CVE-2026-0572
WebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options
Medium
CVE-2025-15482
Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-15508
Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
High
CVE-2026-24053
Claude Code has a Path Restriction Bypass via ZSH Clobber which Allows Arbitrary File Writes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.