Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
An unauthenticated cross-site scripting vulnerability in Contao's comments bundle allows attackers to inject malicious script that executes when a back end user views the Comments module, potentially leading to administrative takeover or code execution.
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.
A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.
An authorization bypass in pacioli's document-layer consent gate allows nested operations to cancel caller-specified pre-existing documents without human consent markers or denial audit entries.
A stored cross-site scripting vulnerability in the PeproDev Ultimate Profile Solutions WordPress plugin allows authenticated users with contributor privileges or higher to inject arbitrary scripts into pages.
A vulnerability in HivePress allows unauthenticated attackers to inject malicious scripts through custom user attribute fields, which execute when users view affected profile pages.
The Listdom plugin for WordPress through version 6.1.2 allows authenticated administrators to delete arbitrary files on the server via path traversal in the 'ix[file]' parameter, potentially leading to remote code execution.
An arbitrary file read vulnerability in the Divi Plus WordPress plugin allows unauthenticated attackers to view sensitive files on the server via an insecure REST endpoint.
A stored DOM-based cross-site scripting vulnerability in the Molongui Authorship plugin allows unauthenticated attackers to inject arbitrary web scripts through comment href attributes, executing them when users visit affected pages.
FunnelKit for WordPress is vulnerable to unauthenticated stored cross-site scripting via checkout order fields. Attackers can inject arbitrary scripts that execute in the browser of users viewing affected pages.
A missing authorization check in AutomatorWP allows authenticated users with subscriber or higher permissions to view Fluent Forms records, exposing form IDs and titles.
A vulnerability in the Avada theme for WordPress allows authenticated users to store malicious scripts in author profile social links. If clicked when links do not open in a new window, the script executes in the victim's browser.
The WPAdverts plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting via the adverts_location parameter. Attackers can inject scripts that execute when users access affected pages.
The LatePoint plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'booking[service_id]' parameter in versions up to 5.7.2. Attackers can exploit this flaw to extract sensitive data from the database.
A stored cross-site scripting vulnerability in the Retainful plugin for WordPress allows authenticated attackers with subscriber-level permissions to inject malicious scripts into web pages.
SureDash for WordPress is vulnerable to stored DOM-based cross-site scripting via image alt attributes in community posts, allowing authenticated users with subscriber privileges or higher to execute arbitrary scripts.
A vulnerability in the WPO365 Login plugin for WordPress allows unauthenticated attackers to inject malicious scripts via forged JWT claims in the id_token parameter, executing when an administrator visits the wizard page.
The Motors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the stm_f_s parameter. Authenticated users with subscriber-level access or higher can inject arbitrary web scripts that execute when pages are viewed.
A vulnerability in WebToffee WooCommerce PDF Invoices through 5.0.2 allows unauthenticated attackers to view sensitive customer order documents if guest access is enabled and order details are known.
An authentication bypass flaw in the WordPress WPO365 | LOGIN plugin allows unauthenticated attackers holding a previously issued token to replay it and take over user accounts, including administrators, when a specific setting is enabled.
A reflected cross-site scripting vulnerability in WPForms allows unauthenticated attackers to execute scripts if a user clicks a malicious link under specific form description configurations.
WP Directory Kit for WordPress is vulnerable to second-order SQL injection through the display_name profile field. Authenticated users with subscriber-level privileges or higher can extract sensitive database information.
The Premium Packages plugin for WordPress is vulnerable to stored cross-site scripting via checkout billing parameters. Authenticated attackers with subscriber-level access can inject malicious scripts that execute in the context of users viewing the affected pages.
A critical vulnerability in the WPCOM Member plugin for WordPress allows unauthenticated attackers to bypass authentication and log in as any user, including administrators, if social login is configured.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.