Critical
CVE-2026-4003
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2026-4406
Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter
High
CVE-2026-34894
Integrio Core < 1.2.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-1672
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Product Data Modification
High
CVE-2026-34893
Thegov Core < 2.0.23 - Unauthenticated Local File Inclusion
High
CVE-2026-34895
Softlab Core < 1.2.11 - Unauthenticated Local File Inclusion
High
CVE-2026-3243
Advanced Members for ACF <= 1.2.5 - Authenticated (Subscriber+) Arbitrary File Deletion via Path Traversal
Medium
CVE-2026-1673
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery to Taxonomy Term Deletion
Critical
CVE-2026-0740
Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload
High
CVE-2026-3666
wpForo Forum <= 2.4.16 - Authenticated (Subscriber+) Arbitrary File Deletion via Post Body
High
CVE-2026-1233
Text to Speech (TTS) by Mementor <= 1.9.8 - Use of Hardcoded Password to Unauthenticated Remote Database Access
Medium
CVE-2026-2826
Kadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload
High
CVE-2026-4350
Perfmatters <= 2.5.9.1 - Authenticated (Subscriber+) Arbitrary File Deletion via 'delete' Parameter
Critical
CVE-2025-15484
Order Notification for WooCommerce – Get Audio Alert on new Orders < 3.6.3 - Unauthenticated Remote Code Execution
Medium
CVE-2026-0688
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2026-0686
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
High
CVE-2026-5032
W3 Total Cache <= 2.9.3 - Unauthenticated Security Token Exposure via User-Agent Header
High
CVE-2026-4347
MW WP Form <= 5.1.0 - Unauthenticated Arbitrary File Move via move_temp_file_to_upload_dir
Medium
CVE-2026-4020
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Critical
CVE-2026-3300
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
Critical
CVE-2026-4257
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
Medium
CVE-2025-15433
Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
Medium
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
Critical
CVE-2025-15488
Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.