Medium
CVE-2026-6810
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-5488
ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'
Medium
CVE-2026-6393
BetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage
Medium
CVE-2026-2028
Maxi Blocks <= 2.1.8 - Missing Authorization to Authenticated (Author+) Media File Deletion via 'old_media_src' Parameter
Medium
CVE-2025-69332
Bookify – Appointment Booking & Scheduling for WordPress <= 1.1.1 - Missing Authorization
High
CVE-2026-41557
Kapee < 1.7.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-40785
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.6.7 - Missing Authorization
Medium
CVE-2026-40790
WSMS (formerly WP SMS) – SMS & MMS Notifications with OTP and 2FA for WooCommerce <= 7.2.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-41556
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-40809
Metro Magazine <= 1.4.1 - Missing Authorization
Medium
CVE-2026-40788
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.9.7 - Missing Authorization
High
CVE-2026-40791
WP Time Slots Booking Form <= 1.2.46 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-28040
E-cab Taxi Booking Manager for Woocommerce <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62110
Rescue Shortcodes <= 3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-40787
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 11.0.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-41554
Bricks <= 1.9.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-32489
bBlocks – Essential Gutenberg Blocks & Patterns Collection < 2.0.30 - Missing Authorization
Medium
CVE-2026-40792
KiviCare – Clinic & Patient Management System (EHR) <= 4.2.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-40789
Booking for Appointments and Events Calendar – Amelia <= 2.2 - Unauthenticated Information Exposure
Medium
CVE-2025-62104
ACF Galerie 4 <= 1.4.2 - Missing Authorization
High
CVE-2025-60085
Learnify - Online Courses Education WordPress Theme <= 1.15.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-64215
MasterStudy LMS Pro < 4.7.16 - Missing Authorization
High
CVE-2026-5464
ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process
Medium
CVE-2026-3361
WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.