Medium
CVE-2026-24549
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-25441
LeadConnector <= 3.0.21 - Missing Authorization
Medium
CVE-2025-15520
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-68999
Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-24991
Extensions For CF7 <= 3.4.0 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-24550
Blockons <= 1.2.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-67969
UPI QR Code Payment Gateway for WooCommerce <= 1.5.1 - Missing Authorization
High
CVE-2025-69295
Coven Core <= 1.3 - Unauthenticated SQL Injection
High
CVE-2025-69294
PeakShops <= 1.5.9 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-1251
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-24992
Advanced WooCommerce Product Sales Reporting <= 4.1.2 - Unauthenticated Information Exposure
High
CVE-2026-24548
Radio Player <= 2.0.91 - Unauthenticated Server-Side Request Forgery
High
CVE-2025-69322
PeakShops < 1.5.9 - Unauthenticated Local File Inclusion
Medium
CVE-2026-24551
Monetag Official <= 1.1.3 - Missing Authorization
Medium
CVE-2026-24994
Sunshine Photo Cart <= 3.5.7.2 - Missing Authorization
High
CVE-2025-68848
amr cron manager <= 2.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2024-11976
BuddyPress <= 14.3.3 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-14069
Schema & Structured Data for WP & AMP <= 1.54 - Authenticated (Contributor+) Stored Cross-Site Scripting via User Custom Schema
Medium
CVE-2026-0927
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload
Medium
CVE-2025-14745
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode
Medium
CVE-2025-15522
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-69183
Hospital Doctor Directory <= 1.3.9 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-69320
Grand Magazine <= 3.5.7 - Reflected Cross-Site Scripting
Medium
CVE-2026-24367
Traveler < 3.2.8 - Authenticated (Contributor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.