Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal
WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
Apache Airflow proxy credentials for various providers might leak in task logs
Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated
PlantUML is vulnerable to Stored XSS due to insufficient sanitization of interactive attributes in GraphViz diagrams
Turn Yoast SEO FAQ Block to Accordion <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update
Post Slides <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion
AWP Classifieds <= 4.4.3 - Unauthenticated Information Exposure
bidorbuy Store Integrator <= 2.12.0 - Reflected Cross-Site Scripting
Antideo Email Validator <= 1.0.10 - Unauthenticated SQL Injection
CM Business Directory – Optimise and showcase local business <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting
Tickera <= 3.5.6.2 - Missing Authorization
User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure
Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute
Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
The Aisle < 2.9.1 - Unauthenticated Local File Inclusion
Client Portal – Private user pages and login <= 1.2.1 - Missing Authorization
Syntax Highlighter Compress <= 3.0.83.3 - Reflected Cross-Site Scripting
Modular DS 2.5.2 - Unauthenticated Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.