Medium
CVE-2026-4668
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-2480
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'max_width' Shortcode Attribute
Medium
CVE-2026-34886
Simple Membership <= 4.7.1 - Missing Authorization
Medium
CVE-2025-13535
King Addons for Elementor <= 51.1.38 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2026-40764
Contact Form by WPForms <= 1.10.0.2 - Cross-Site Request Forgery
Medium
CVE-2026-34887
Kubio AI Page Builder <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-40763
Royal Elementor Addons <= 1.7.1056 - Missing Authorization
Medium
CVE-2026-3191
Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-3139
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.15.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Post Author Reassignment via Avatar Field
Medium
CVE-2026-1877
Auto Post Scheduler <= 1.84 - Cross-Site Request Forgery to Stored Cross-Site Scripting via aps_options_page
Medium
CVE-2026-1834
Ibtana - WordPress Website Builder <= 1.2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-1797
Truebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files
Medium
CVE-2026-1710
WooPayments <= 10.5.1 - Missing Authorization to Unauthenticated Plugin Settings Update via save_upe_appearance_ajax
Medium
CVE-2026-4146
Loco Translate <= 2.8.2 - Reflected Cross-Site Scripting via 'update_href' Parameter
Medium
CVE-2026-4020
Gravity SMTP <= 2.1.4 - Unauthenticated Sensitive Information Exposure via REST API
Critical
CVE-2026-3300
Everest Forms Pro <= 1.9.12 - Unauthenticated Remote Code Execution via Calculation Field
High
CVE-2026-5130
Debugger & Troubleshooter <= 1.3.2 - Unauthenticated Privilege Escalation to Administrator via Cookie Manipulation
Critical
CVE-2026-4257
Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality
Medium
CVE-2026-45214
Xpro Elementor Addons <= 1.5.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-15433
Shared Files – Frontend File Upload Form & Secure File Sharing < 1.7.58 - Authenticated (Contributor+) Arbitrary File Download
Medium
CVE-2026-45213
BEAR <= 1.1.7.1 - Authenticated (Shop manager+) SQL Injection
Critical
CVE-2025-15488
Responsive Plus – Elementor Templates & Starter Sites < 3.4.3 - Unauthenticated Arbitrary Code Execution
Critical
CVE-2026-1969
ThemeREX Addons < 2.38.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-1430
WP Lightbox 2 < 3.0.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.