Medium
CVE-2026-39702
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,089
Reset filters
High
CVE-2026-28092
Sounder | Internet Radio & Streaming Elementor Template Kit <= 1.3.11 - Unauthenticated Local File Inclusion
High
CVE-2026-28059
Dermatology Clinic <= 1.4.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-14149
Xpro Addons — 140+ Widgets for Elementor <= 1.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Scroller Widget box link
Medium
e5b98a2c-faed-4e2b-8b94-31e2be95ad40
WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.4 - Unauthenticated Reflected Cross-Site Scripting via 'title_tag' Parameter
Medium
CVE-2026-28135
Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1052 - Missing Authorization
Medium
CVE-2026-23693
ElementsKit Elementor addons Lite < 3.7.9 - Missing Authorization
High
CVE-2026-27381
Aora - Home & Lifestyle Elementor WooCommerce Theme <= 1.3.15 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27376
Claue - Clean, Minimal Elementor WooCommerce <= 2.2.7 - Reflected Cross-Site Scripting
High
CVE-2026-27439
Dentario <= 1.5 - Unauthenticated PHP Object Injection
Medium
CVE-2026-2385
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Unauthenticated Email Relay
Medium
CVE-2026-25387
Image Optimizer by Elementor <= 1.7.1 - Missing Authorization
Medium
CVE-2026-32395
Xpro Addons For Beaver Builder – Lite <= 1.5.6 - Missing Authorization
Medium
CVE-2026-2486
Master Addons For Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ma_el_bh_table_btn_text'
Medium
CVE-2026-2284
News Element Elementor Blog Magazine <= 1.0.8 - Missing Authorization to Authenticated (Subscriber+) Data Loss
Medium
CVE-2026-2386
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.7 - Incorrect Authorization to Authenticated (Author+) Arbitrary Draft Post Creation via 'post_type'
Medium
CVE-2026-32372
ShopBuilder – Elementor WooCommerce Builder Addons <= 3.2.4 - Unauthenticated Information Exposure
High
CVE-2026-1714
ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
High
CVE-2026-22363
Rhodos <= 1.3.3 - Unauthenticated Local File Inclusion
High
CVE-2026-22373
Fooddy <= 1.3.10 - Unauthenticated Local File Inclusion
High
CVE-2026-22378
Blabber <= 1.7.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-1793
Element Pack Addons for Elementor <= 8.3.17 - Authenticated (Contributor+) Arbitrary File Read
Medium
CVE-2026-1512
Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
Medium
CVE-2026-39636
Livemesh Addons for Elementor <= 9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.