Medium
CVE-2026-24576
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-24579
Ai Image Alt Text Generator for WP <= 1.1.9 - Missing Authorization
High
CVE-2025-67947
AdForest Elementor <= 3.0.11 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-68520
DotLife < 4.9.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-25451
Bold Page Builder <= 5.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-69316
TableOn <= 1.0.4.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-68900
Enfold <= 7.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-68839
Easy Theme Options <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-68518
Hoteller < 6.8.9 - Reflected Cross-Site Scripting
High
CVE-2025-67946
AdForest <= 6.0.11 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68538
Craft <= 2.3.6 - Reflected Cross-Site Scripting
Medium
CVE-2026-24578
Admin login URL Change <= 1.1.5 - Missing Authorization
Medium
CVE-2026-24986
Simple Membership WP user Import <= 1.9.1 - Cross-Site Request Forgery
Medium
CVE-2025-68840
iRobots.txt SEO <= 1.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-69315
Simply Schedule Appointments <= 1.6.9.15 - Missing Authorization
High
CVE-2026-22336
Directorist Booking <= 2.4.1 - Unauthenticated SQL Injection
Medium
CVE-2025-68046
Contact Form & Lead Form Elementor Builder <= 2.0.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-68020
WANotifier <= 2.7.13 - Missing Authorization
Critical
CVE-2025-14533
Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action
Medium
CVE-2026-1042
WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters
Medium
CVE-2026-1045
Viet contact <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters
Medium
CVE-2025-14348
weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure
High
CVE-2025-14977
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
Medium
CVE-2025-14351
Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.