Medium
CVE-2026-62079
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-97288
WP OAuth Server (OAuth Authentication) <= 4.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-91022
Motors <= 1.4.123 - Authenticated (Listing Manager+) Stored Cross-Site Scripting
Medium
CVE-2026-94298
BuildKit <= 1.0.28 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-97074
Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-92712
ReactPress <= 3.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'permalink' Parameter
Medium
CVE-2025-14564
Viable URL Media Uploader <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2026-97347
Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
Medium
CVE-2026-93908
Real Estate Manager <= 7.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'before_price_text' Parameter
High
CVE-2026-75098
Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design
Medium
CVE-2026-16596
WP Directory Kit <= 1.5.4 - Authenticated (Custom+) SQL Injection via 'data_fields_list' Parameter
Medium
CVE-2026-14876
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-href' Attribute in Custom HTML Block
High
CVE-2026-6806
Motors <= 1.4.109 - Unauthenticated Blind SQL Injection via 'stm_lat'/'stm_lng' Parameters
Medium
CVE-2026-11895
HT Mega Addons for Elementor <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data Table 'display_options' Setting
Medium
CVE-2026-88037
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_service title
Medium
CVE-2026-6173
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'background_image' Parameter
Medium
CVE-2026-6170
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_css_image_grid 'images' Shortcode Attribute
Medium
CVE-2026-6171
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute
Medium
CVE-2026-6172
Bold Page Builder <= 5.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'caption' Parameter
High
CVE-2026-89294
Simply Schedule Appointments <= 1.6.12.27 - Authenticated (Subscriber+) Local File Inclusion via 'ssa_locale' Parameter
High
CVE-2026-96649
Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
Medium
CVE-2026-97243
AllAble Connector <= 0.13.4 - Missing Authorization
Medium
CVE-2026-97241
BackupEase – Scheduled Backup, Restore & Site Migration <= 2.2.2 - Unauthenticated Information Exposure
Medium
CVE-2026-97240
StifLi Backup Tools <= 2.2.7 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.