Critical
CVE-2026-13423
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-13080
WPFunnels <= 3.12.7 - Authenticated (Administrator+) Local File Inclusion via 'logKey' Parameter
Medium
CVE-2026-57413
Instant AI Image Generator – Create & Import Images <= 2.1.4 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2026-57407
PDF Generator for WordPress <= 1.6.2 - Authenticated (Subscriber+) Server-side Request Forgery
High
CVE-2026-57815
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.55.0.2 - Unauthenticated Arbitrary File Download
High
CVE-2026-11974
Media folder Addon <= 4.1.6 - Unauthenticated Arbitrary File Read
High
CVE-2026-57389
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.4.1 - Authenticated (Sales Representative+) Arbitrary File Deletion
High
CVE-2026-57401
SureDash – Community, Courses & Member Dashboard <= 1.8.0 - Authenticated (SureDash User+) Arbitrary File Deletion
High
CVE-2026-14489
WHMCS Bridge <= 6.9 - Unauthenticated Arbitrary File Upload via 'ccce' Parameter
Medium
CVE-2026-14500
Bulk Order Update for WooCommerce <= 1.6 - Unauthenticated Arbitrary File Read via 'csv_url' Parameter
Critical
CVE-2026-14487
Simple Coherent Form <= 2.4.13 - Unauthenticated Arbitrary File Deletion via 'id' Parameter
High
CVE-2026-14244
Jssor Slider by jssor.com <= 3.1.24 - Unauthenticated Arbitrary File Read via 'url' Parameter
High
CVE-2026-14158
Widget Logic Visual <= 1.52 - Authenticated (Subscriber+) Remote Code Execution via 'nwlv[cod-tag]' Parameter
High
CVE-2026-57372
WPJAM Basic <= 7.0 - Unauthenticated Server-Side Request Forgery
Critical
CVE-2026-14345
WPFunnels <= 3.12.7 - Unauthenticated Remote Code Execution via 'postData' Parameter
Critical
CVE-2026-14289
FacturaONE <= 5.36 - Unauthenticated Remote Code Execution
Critical
CVE-2026-14812
Premium SEO - Malicious Plugin
High
CVE-2025-15662
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Read
High
CVE-2026-57743
RT-Theme 18 Responsive WordPress Theme <= 2.5 - Unauthenticated Local File Inclusion
High
CVE-2026-6101
AMP for WP <= 1.1.12 - Authenticated (Author+) Arbitrary File Write via Role-Based Access Configuration with Local Font Upload
Critical
CVE-2026-13714
Realtyna Organic IDX plugin + WPL Real Estate <= 5.2.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-5137
RTMKit <= 2.0.7 - Authenticated (Contributor+) Limited Local File Inclusion via 'template' Parameter
Medium
CVE-2026-11397
WP Import Export Lite <= 3.9.30 - Authenticated (Administrator+) Server-Side Request Forgery via 'file_url' Parameter
Critical
CVE-2026-9725
Printcart Web to Print Product Designer for WooCommerce <= 2.5.2 - Unauthenticated Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.