Medium
CVE-2026-25420
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-24380
EventPrime <= 4.2.8.0 - Missing Authorization
High
CVE-2026-1280
Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
High
CVE-2026-15298
TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title
High
CVE-2025-14386
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.15 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover
High
CVE-2026-1400
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint
High
CVE-2026-0832
New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure
Medium
CVE-2026-0825
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
Medium
CVE-2026-1244
Forms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Medium
CVE-2026-0746
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-68069
Directorist <= 8.6.6 - Missing Authorization
High
CVE-2025-69301
PhotoMe <= 5.6.11 - Unauthenticated PHP Object Injection
Medium
CVE-2025-68021
ConveyThis <= 270.4 - Missing Authorization
High
CVE-2025-68531
ModelTheme Addons for WPBakery and Elementor < 1.5.6 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-67974
WPLegalPages <= 3.5.4 - Missing Authorization
Medium
CVE-2026-1060
WP Adminify <= 4.0.7.7 - Unauthenticated Sensitive Information Exposure via 'get-addons-list' REST API
Medium
CVE-2025-14795
Stop Spammers Classic <= 2026.1 - Cross-Site Request Forgery via Email Allowlist
Medium
CVE-2026-24521
Kama Thumbnail <= 3.5.1 - Cross-Site Request Forgery
Medium
CVE-2026-25316
CartFlows – Checkout & Funnel Builder for WooCommerce <= 2.1.19 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2026-24377
Nexter Blocks <= 4.6.3 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-24526
Email Inquiry & Cart Options for WooCommerce <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-24531
Prowess <= 2.3 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-24998
Hustle <= 7.8.9.2 - Unauthenticated Information Exposure
High
CVE-2026-24538
Omnipress <= 1.6.7 - Authenticated (Contributor+) Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.