High
CVE-2025-69407
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2025-69406
FreightCo <= 1.1.7 - Unauthenticated Local File Inclusion
High
CVE-2025-69410
Belletrist <= 1.2 - Unauthenticated Local File Inclusion
High
CVE-2025-69408
HealthFirst <= 1.0.1 - Unauthenticated Local File Inclusion
High
CVE-2025-69397
Tint <= 1.7 - Unauthenticated Local File Inclusion
High
CVE-2025-15096
Videospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
Medium
CVE-2026-1748
Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Critical
CVE-2026-1357
Migration, Backup, Staging <= 0.9.123 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-15524
Gallery by FooGallery <= 3.1.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Metadata Exposure
High
CVE-2026-39613
Boutique <= 2.3.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-15286
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.5.32 - Incorrect Authorization to Authenticated (Contributor+) Post Publication
High
CVE-2026-0910
wpForo Forum <= 2.4.13 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-68552
WooCommerce Coming Soon Product with Countdown <= 5.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2026-1866
Name Directory <= 1.32.0 - Unauthenticated Stored Cross-Site Scripting via Double HTML-Entity Encoding in Submission Form
High
CVE-2026-2268
Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action
Medium
CVE-2025-14895
PopupKit <= 2.2.0 - Missing Authorization to Sensitive Information Disclosure and Data Deletion
Medium
CVE-2026-0996
Fluent Forms <= 6.1.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via AI Form Builder Module
High
CVE-2026-0845
WCFM - WooCommerce Frontend Manager <= 6.7.24 - Authenticated (Shop Manager+) Arbitrary Options Update
High
CVE-2025-67995
PatioTime < 2.1 - Unauthenticated PHP Object Injection
High
CVE-2025-69387
Simple Retail Menus <= 4.2.1 - Unauthenticated Local File Inclusion
High
CVE-2025-67992
PatioTime < 2.1 - Unauthenticated Local File Inclusion
High
CVE-2025-67997
Travelicious < 1.6.7 - Unauthenticated PHP Object Injection
Medium
CVE-2026-24953
Simple File List <= 6.1.15 - Authenticated (Subscriber+) Arbitrary File Download
Medium
CVE-2025-67993
Atarim <= 4.2.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.