High
CVE-2026-12095
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-9616
Generate Security.txt <= 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action
Medium
CVE-2026-8622
Image Sizes on Demand <= 1.3 - Reflected Cross-Site Scripting via PHP_SELF Server Variable
High
CVE-2026-8705
ClearSale Total <= 3.4.2 - Unauthenticated SQL Injection
High
CVE-2026-12242
AdRotate Banner Manager <= 5.17.7 - Authenticated (Contributor+) PHP Code Injection via 'banner' Shortcode Attribute
High
CVE-2026-12511
AI Engine <= 3.5.4 - Authenticated (Editor+) Arbitrary File Write
Medium
CVE-2026-56026
utm.codes <= 1.9.0 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-11563
Word Count and Social Shares <= 1.0 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2026-56027
Booster for WooCommerce – PDF Invoices, Abandoned Cart, Variation Swatches & 100+ Tools <= 8.0.1 - Authenticated (Customer+) Arbitrary File Upload
High
CVE-2026-11911
Simple File List <= 6.3.7 - Unauthenticated Arbitrary File Deletion via Path Traversal in 'eeSubFolder' Parameter
High
CVE-2026-11912
Simple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action
High
CVE-2026-9843
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.1 - Unauthenticated Arbitrary File Deletion via CF7 File Field POST Value
Critical
CVE-2026-7515
BetterDocs Pro <= 3.8.0 - Unauthenticated Local File Inclusion via doc_style
Critical
CVE-2026-8713
Avada (Fusion) Builder <= 3.15.3 - Unauthenticated Arbitrary File Deletion via Form Entry Value
Medium
CVE-2026-7547
Woosa <= 2.0.5 - Authenticated (Administrator+) Arbitrary File Read via 'log_file' Parameter
Medium
CVE-2026-11989
Bit integrations <= 2.8.7 - Unauthenticated Server-Side Request Forgery via Form Field Upload Mapping
Medium
CVE-2026-4328
Advanced Import: One-Click Demo Import for WordPress <= 1.4.6 - Authenticated (Author+) Server-Side Request Forgery via 'demo_file' Parameter
Medium
CVE-2026-12157
BetterDocs <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'blockId' Block Attribute
High
CVE-2026-12516
Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-54845
MDTF – Meta Data and Taxonomies Filter <= 1.3.8 - Unauthenticated Local File Inclusion
High
CVE-2026-12517
Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
High
CVE-2026-11395
CF7 to Webhook <= 5.0.0 - Unauthenticated Server-Side Request Forgery via CF7 Field Placeholder in Webhook URL Host
High
CVE-2026-9860
Offload, AI & Optimize with Cloudflare Images <= 1.10.2 - Authenticated (Author+) Remote Code Execution via 'api-key' / 'account-id' Parameters in cf_images_do_setup AJAX Action
Medium
CVE-2026-11357
Kadence Blocks <= 3.7.5 - Authenticated (Contributor+) Sensitive Information Exposure via Block Editor proData Localization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.