Critical
CVE-2026-3844
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-2951
Gutentor – Gutenberg Blocks – Page Builder for Gutenberg Editor <= 3.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gutentor Block HTML
Medium
CVE-2026-1923
Social Rocket – Social Sharing Plugin <= 1.3.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via id
High
CVE-2026-39449
Contact Form to Any API <= 3.0.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40781
ReviewX – Multi-Criteria Reviews for WooCommerce with Google Reviews & Schema <= 2.3.6 - Missing Authorization
High
CVE-2026-39443
EmallShop <= 2.4.21 - Unauthenticated PHP Object Injection
Medium
CVE-2026-40780
Bookit — Booking & Appointment Calendar <= 2.5.1 - Missing Authorization
Medium
CVE-2025-58922
Avada < 7.13.2 - Cross-Site Request Forgery
Medium
CVE-2026-25440
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization
High
CVE-2026-39442
PressMart <= 1.2.26 - Unauthenticated PHP Object Injection
Medium
CVE-2026-40783
Blocksy Companion Pro <= 2.1.37 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-40782
WPAdverts – Classifieds Plugin <= 2.3.0 - Missing Authorization
High
CVE-2026-39445
Alukas < 3.0.0 - Unauthenticated PHP Object Injection
High
CVE-2026-40779
Link Library <= 7.8.8 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-39441
Feed KuantoKusta for WooCommerce – Free <= 5.3 - Unauthenticated SQL Injection
High
CVE-2026-39446
Kapee < 1.7.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39450
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.7.3 - Missing Authorization
Medium
CVE-2026-1395
Gutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes
Medium
CVE-2026-1913
Gallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute
Medium
CVE-2026-1930
Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
Medium
CVE-2026-3362
Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting
Medium
CVE-2026-2719
Private WP suite <= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting
Medium
CVE-2026-1845
Real Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings
High
CVE-2026-4132
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.