High
CVE-2026-7522
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-8627
Correct Prices <= 1.0 - Reflected Cross-Site Scripting via PHP_SELF Parameter
Medium
CVE-2026-6401
Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-6394
Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
Critical
CVE-2026-4885
Piotnet Addons for Elementor Pro <= 7.1.70 - Unauthenticated Arbitrary File Upload via Form File Upload
Critical
CVE-2026-4883
Piotnet Forms <= 2.1.40 - Unauthenticated Arbitrary File Upload via Form File Upload
Medium
CVE-2026-42679
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download
High
CVE-2018-25329
WP with Spritz <= 1.0 - Unauthenticated Local File Inclusion
High
CVE-2018-25324
Simple Fields <= 0.3.5 - Unauthenticated Local File Inclusion
High
CVE-2020-37227
Helios Solutions Brand Logo Slider <= 2.1 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2021-47979
Backup and Restore plugin – WordPress <= 1.0.3 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2020-37246
Backup by Supsystic <= 2.3.9 - Unauthenticated Local File Inclusion
High
CVE-2021-47965
WP Super Edit <= 2.5.4 - Unauthenticated Arbitrary File Upload
High
CVE-2026-6403
Quick Playground <= 1.3.3 - Unauthenticated Path Traversal to Arbitrary File Read via 'stylesheet' Parameter
High
CVE-2026-3892
Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter
High
CVE-2026-4030
Database Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion
Medium
CVE-2026-4782
Avada Builder <= 3.15.2 - Authenticated (Subscriber+) Arbitrary File Read via 'custom_svg' Shortcode Parameter
Critical
CVE-2026-6433
Custom css-js-php <= 2.0.7 - Unauthenticated Remote Code Execution
High
CVE-2026-3425
RTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Local File Inclusion via 'path'
Medium
CVE-2026-6663
GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent
Medium
CVE-2026-27415
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery
High
CVE-2026-7252
WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
Medium
CVE-2026-6344
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
High
CVE-2026-5192
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.52.1 - Unauthenticated Arbitrary File Read via 'upload-1[file][file_path]'
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.