Medium
CVE-2025-68604
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2026-40798
wpForo Forum <= 3.0.4 - Unauthenticated SQL Injection
Medium
CVE-2026-27416
PDF Poster – Display PDF Files with Custom Viewer <= 2.4.1 - Missing Authorization
Medium
CVE-2026-27415
BEAR – Bulk Editor and Products Manager Professional for WooCommerce by Pluginus.Net <= 1.1.5 - Cross-Site Request Forgery
High
CVE-2026-42773
eMagicOne Store Manager for WooCommerce <= 1.3.2 - Unauthenticated SQL Injection
Medium
CVE-2026-27421
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-68060
Team Members – Multi Language Supported Team Plugin <= 8.5 - Authenticated (Editor+) SQL Injection
Medium
CVE-2026-27329
YITH WooCommerce Wishlist <= 4.12.0 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-68049
bunny.net – WordPress CDN Plugin <= 2.3.6 - Missing Authorization
Medium
CVE-2026-7862
Eupago Gateway For Woocommerce <= 4.7.1 - Missing Authorization to Unauthenticated Arbitrary Refund Initiation
Medium
CVE-2026-25436
Royal Addons for Elementor – Addons and Templates Kit for Elementor < 1.7.1053 - Missing Authorization
High
CVE-2026-6692
Slider Revolution 7.0.0 - 7.0.10 - Authenticated (Subscriber+) Arbitrary File Upload via _get_media_url
High
CVE-2026-7252
WP-Optimize <= 4.5.2 - Authenticated (Author+) Arbitrary File Deletion via 'original-file' Post Meta
High
CVE-2026-4348
BetterDocs Pro <= 3.7.0 - Unauthenticated SQL Injection via Encyclopedia 'limit' Parameter
Medium
CVE-2026-6214
Forminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook
Medium
CVE-2026-4807
Appointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion
Medium
CVE-2026-6222
Forminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter
High
CVE-2026-7448
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42653
Affiliate Program Suite — SliceWP Affiliates <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-1719
Gravity Bookings <= 2.5.9 - Unauthenticated SQL Injection via 'category_id' Parameter
High
CVE-2026-7332
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
Medium
CVE-2026-7457
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
Medium
CVE-2026-6344
Fluent Forms <= 6.2.1 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal in Email Attachment
Medium
CVE-2026-6672
Affiliate Program Suite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via slicewp_affiliate_url Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.