Medium
CVE-2026-1389
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-1054
RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification
Medium
CVE-2026-1310
Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion
Medium
CVE-2025-12709
Interactions – Create Interactive Experiences in the Block Editor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-0832
New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure
Medium
CVE-2026-0825
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.5 - Missing Authorization to Unauthenticated Form Data Exfiltration via CSV Export
Medium
CVE-2025-9082
WPBITS Addons For Elementor <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-1244
Forms Bridge <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
High
CVE-2025-14610
TableMaster for Elementor <= 1.3.6 - Authenticated (Author+) Server-Side Request Forgery via 'csv_url' Parameter
Medium
CVE-2026-1083
Appointment Hour Booking – Booking Calendar <= 1.5.60 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Min/Max Length' Field Configuration
Medium
CVE-2025-8072
Target Video Easy Publish <= 3.8.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via placeholder_img Parameter
Medium
CVE-2026-1298
Easy Replace Image <= 3.5.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Attachment Replacement
Medium
CVE-2026-0746
AI Engine <= 3.3.2 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2025-67972
Prague <= 2.2.8 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-68846
Asynchronous Javascript <= 1.3.5 - Reflected Cross-Site Scripting
High
CVE-2025-69299
Oxygen <= 6.0.8 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-68050
Leadpages <= 1.1.3 - Missing Authorization
Medium
CVE-2026-22339
WPJobster <= 6.3.5 - Reflected Cross-Site Scripting
High
CVE-2025-67971
FluentCart < 1.3.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-68855
JobBoard Job listing <= 1.2.8 - Unauthenticated Information Exposure
High
CVE-2025-69304
Allmart <= 1.1 - Unauthenticated SQL Injection
Medium
CVE-2026-25428
TS Poll – Survey, Versus Poll, Image Poll, Video Poll <= 2.5.5 - Authenticated (Editor+) Server-Side Request Forgery
Medium
CVE-2025-67973
Sunshine Photo Cart <= 3.5.6.2 - Missing Authorization
Medium
CVE-2025-68837
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.