High
CVE-2026-25027
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2025-69324
NEX-Forms <= 9.1.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-67980
Hara <= 1.2.17 - Unauthenticated Local File Inclusion
High
CVE-2025-67984
NPS computy <= 2.8.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-67979
WPForms Google Sheet Connector <= 4.0.1 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-23976
Modula Image Gallery <= 2.13.4 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-68037
Export Media URLs <= 2.2 - Reflected Cross-Site Scripting
High
CVE-2025-15368
SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode
Medium
CVE-2026-0679
Fortis for WooCommerce <= 1.2.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid via 'wc-api' Endpoint
Medium
CVE-2025-15487
Code Explorer <= 1.4.6 - Authenticated (Administrator+) Arbitrary File Read via 'file' Parameter
Medium
CVE-2025-15260
MyRewards – Loyalty Points and Rewards for WooCommerce <= 5.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Loyalty Rule Modification
Medium
CVE-2026-0816
All push notification for WP <= 1.5.3 - Authenticated (Administrator+) SQL Injection via 'delete_id' Parameter
High
CVE-2025-15268
Infility Global <= 2.14.46 - Unauthenticated SQL Injection via Predictable API Key and IP Whitelist Bypass
Medium
CVE-2026-0742
Smart Appointment & Booking <= 1.0.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via saab_save_form_data AJAX Action
Medium
CVE-2026-0743
WP Content Permission <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'ohmem-message' Parameter
Medium
CVE-2026-0572
WebPurify Profanity Filter <= 4.0.2 - Missing Authorization to Unauthenticated Plugin Settings Change via webpurify_save_options
Medium
CVE-2025-15482
Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-15508
Magic Import Document Extractor <= 1.0.6 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-15507
Magic Import Document Extractor <= 1.0.5 - Missing Authorization to Unauthenticated Plugin License Status Modification
Medium
CVE-2025-14461
Xendit Payment <= 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Update to Paid
High
CVE-2025-15285
SEO Flow by LupsOnline <= 2.2.1 - Unauthenticated Arbitrary Post/Category Modification
Medium
CVE-2026-1370
SIBS - WooCommerce <= 2.2.0 - Authenticated (Admin+) SQL Injection via 'referencedId' Parameter
Medium
CVE-2026-0681
Extended Random Number Generator <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
High
CVE-2026-1756
WP FOFT Loader <= 2.1.39 - Authenticated (Author+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.