Medium
CVE-2026-2375
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-4077
Ecover Builder For Dummies <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Medium
CVE-2026-4022
Show Posts list <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-4086
WP Random Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'cat' Shortcode Attribute
High
CVE-2026-2468
Quentn WP <= 1.2.12 - Unauthenticated SQL Injection via 'qntn_wp_access' Cookie
High
CVE-2026-3003
Vagaro Booking Widget <= 0.3 - Unauthenticated Stored Cross-Site Scripting via 'vagaro_code'
Medium
CVE-2026-3506
WP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover
High
CVE-2026-2941
Linksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details
Medium
CVE-2026-4087
Pre* Party Resource Hints <= 1.8.20 - Authenticated (Subscriber+) SQL Injection via 'hint_ids' Parameter
High
CVE-2026-4261
Expire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields
Medium
CVE-2026-4083
Scoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-3474
EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
Medium
CVE-2026-3516
Contact List <= 3.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via '_cl_map_iframe' Parameter
High
CVE-2026-3368
Injection Guard <= 1.2.9 - Unauthenticated Stored Cross-Site Scripting via Query Parameter Name
Medium
CVE-2026-3350
Image Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title
Critical
CVE-2026-3584
Kali Forms <= 2.4.9 - Unauthenticated Remote Code Execution via form_process
High
CVE-2026-25359
Pendulum < 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2026-32522
WooCommerce Support Ticket System < 18.5 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-31921
Product Rearrange for WooCommerce <= 1.2.2 - Missing Authorization
Medium
CVE-2026-32545
Taboola Pixel <= 1.1.4 - Reflected Cross-Site Scripting
High
CVE-2026-32499
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection
High
CVE-2026-32531
Kunco < 1.4.5 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25304
Jaroti < 1.4.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-32542
Avada (Fusion) Builder < 3.15.0 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.