Medium
CVE-2026-6247
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-6237
Quick Table <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
High
CVE-2026-4935
OttoKit: All-in-One Automation Platform < 1.1.23 - Unauthenticated SQL Injection
Critical
CVE-2021-47932
TheCartPress eCommerce Shopping Cart <= 1.5.3.6 - Unauthenticated Privilege Escalation
Medium
CVE-2026-42666
Salon Booking System – Free Version <= 10.30.25 - Missing Authorization
High
CVE-2021-47941
WordPress Survey & Pol <= 1.5.7.3 - Unauthenticated SQL Injection
Medium
CVE-2022-50959
Contact Form Builder, Contact Widget <= 1.6.1 - Reflected Cross-Site Scripting
Medium
CVE-2022-50960
International Sms For Contact Form 7 Integration <= 1.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-42667
Online Scheduling and Appointment Booking System – Bookly <= 27.4 - Unauthenticated Information Exposure
Medium
CVE-2026-45218
WP Travel – Ultimate Travel Booking System, Tour Management Engine <= 11.4.0 - Authenticated (Contributor+) SQL Injection
High
CVE-2026-42665
WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards <= 5.5.70 - Unauthenticated SQL Injection
Medium
CVE-2026-42664
AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 - Missing Authorization
Medium
CVE-2026-8198
Activity Logs, User Activity Tracking, Multisite Activity Log from Logtivity <= 3.3.6 - Unauthenticated Information Disclosure via REST API
Medium
CVE-2026-7652
LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism
Medium
CVE-2025-68524
Avante < 3.0.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-40799
Simple CAPTCHA Alternative with Cloudflare Turnstile <= 1.38.0 - Broken Authorization
Medium
CVE-2026-5341
NMR Strava activities <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-7475
Sky Addons <= 3.3.2 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Script
Medium
CVE-2026-7650
E2Pdf – Export Pdf Tool for WordPress <= 1.32.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
High
CVE-2026-7330
Auto Affiliate Links <= 6.8.8 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
High
CVE-2026-5127
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.1 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-66105
Bus Ticket Booking with Seat Reservation < 5.6.8 - Missing Authorization
Medium
CVE-2025-62127
WEN Logo Slider <= 3.4.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-25468
Happy Addons for Elementor <= 3.20.8 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.