Medium
CVE-2026-25368
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2026-22356
Jetpack CRM <= 6.7.0 - Unauthenticated Local File Inclusion
High
CVE-2025-68541
Ippsum <= 1.2.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39650
UnitechPay <= 1.0.2 - Missing Authorization
Medium
061a14bf-d067-4924-b2f4-2f5986204532
SureForms <= 2.2.1 - Missing Authorization
Medium
CVE-2026-1793
Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
High
CVE-2026-1750
Ecwid by Lightspeed Ecommerce Shopping Cart <= 7.0.7 - Authenticated (Subscriber+) Privilege Escalation via ec_store_admin_access
High
CVE-2026-32355
JetEngine < 3.8.4.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-25348
Download Alt Text AI <= 1.10.15 - Missing Authorization
Medium
CVE-2026-1258
Mail Mint <= 1.19.2 - Authenticated (Administrator+) SQL Injection via Multiple API Endpoints
Medium
CVE-2026-1254
Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
Critical
CVE-2026-1306
midi-Synth <= 1.1.0 - Unauthenticated Arbitrary File Upload via 'export' AJAX Action
Medium
CVE-2026-1985
Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
Medium
CVE-2026-2022
Smart Forms <= 2.6.100 - Missing Authorization to Authenticated (Subscriber+) Campaign Data Exposure
Medium
CVE-2026-1303
MailChimp Campaigns <= 3.2.4 - Missing Authorization to Authenticated (Subscriber+) MailChimp App Disconnection
High
CVE-2026-15288
SureForms – Drag and Drop Form Builder for WordPress <= 2.2.1 - Unauthenticated Stripe Payment Amount Manipulation
High
CVE-2026-2144
Magic Login Mail or QR Code <= 2.05 - Unauthenticated Privilege Escalation via Insecure QR Code File Storage
High
CVE-2026-0692
BlueSnap Payment Gateway for WooCommerce <= 3.4.0 - Missing Authorization to Unauthenticated Arbitrary Order Status Manipulation
Medium
CVE-2026-1164
Easy Voice Mail <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting via 'message'
Medium
CVE-2025-13681
BFG Tools – Extension Zipper <= 1.0.7 - Authenticated (Administrator+) Path Traversal via 'first_file' Parameter
Medium
CVE-2025-13973
StickEasy Protected Contact Form <= 1.0.1 - Unauthenticated Information Disclosure
High
CVE-2025-15157
Starfish Review Generation & Marketing for WordPress <= 3.1.19 - Authenticated (Subscriber+) Arbitrary Options Update via srm_restore_options_defaults
Medium
CVE-2026-32353
MailerPress <= 1.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
Critical
CVE-2026-2446
Powerpack for LearnDash <= 1.2.0 - Unauthenticated Arbitrary Options Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.