Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
ibexa/user login enumerates user accounts
WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning
Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module
Keycloak error_description injection on error pages that can trigger phishing attacks
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery
ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export
Mammoth is vulnerable to Directory Traversal
Sale! Immigration law, Visa services support, Migration Agent Consulting <= 1.5.8 - Authenticated (Subscriber+) Privilege Escalation
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
XStore Core < 5.6 - Reflected Cross-Site Scripting
Memberlite Shortcodes <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting
XX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection
Admin Management Xtended <= 2.5.1 - Missing Authorization
GoCache <= 1.3.6 - Missing Authorization
Angular SSR has a Server-Side Request Forgery (SSRF) flaw
Binary MLM Plan <= 5.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
bagisto has Cross Site Scripting (XSS) in Create New Customer
bagisto has CSV Formula Injection in Create New Product
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.