Medium
CVE-2026-2433
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 378
Reset filters
Medium
CVE-2026-2893
Page and Post Clone <= 6.3 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter
High
CVE-2026-2471
WP Mail Logging <= 1.15.0 - Unauthenticated PHP Object Injection via Email Log Message Field
Critical
CVE-2026-1357
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
High
CVE-2026-1058
Form Maker by 10Web <= 1.15.35 - Unauthenticated Stored Cross-Site Scripting via Hidden Field
High
CVE-2025-11504
Quickcreator – AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key Exposure
Medium
CVE-2025-11241
Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13539
AForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure
Medium
CVE-2024-13426
WP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting
Medium
CVE-2024-6155
Greenshift – animation and page builder blocks <= 9.0.0 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery and Stored Cross-Site Scripting
Medium
CVE-2024-3866
Ninja Forms Contact Form <= 3.8.15 - Reflected Self-Based Cross-Site Scripting via Referer
High
CVE-2022-2446
WP Editor <= 1.2.9 - Authenticated (Admin+) PHAR Deserialization
High
CVE-2022-2440
Theme Editor <= 2.8 - Authenticated (Admin+) PHAR Deserialization
Medium
CVE-2024-6254
Brizy – Page Builder <= 2.5.1 - Cross-Site Request Forgery
Medium
CVE-2024-1766
Download Manager <= 3.2.86 - Authenticated (Subscriber+) Stored Self-Based Cross-Site Scripting
High
CVE-2023-7064
Shortcodes and extra features for Phlox theme <= 2.17.5 - Authenticated (Subscriber+) PHP Object Injection via auxin_template_control_importer
Medium
CVE-2024-1720
User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting
Medium
CVE-2024-1985
Simple Membership <= 4.4.2 - Unauthenticated Stored Self-Based Cross-Site Scripting
High
CVE-2024-22290
Custom Dashboard Widgets <= 1.3.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting via cdw_DashboardWidgets
High
CVE-2023-6600
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting
Medium
CVE-2023-32796
WooCommerce Product Enquiry <= 2.6.0 - Unauthenticated Self-Based Cross-Site Scripting
High
CVE-2023-3492
WP Shopping Pages <= 1.14 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
bba3eeeb-5e7e-4ec3-9db0-02c44585647a
WordPress Core < 6.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Embed Discovery
Critical
CVE-2023-32244
Woodmart Core <= 1.0.36 - Authentication Bypass to Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.