Medium
CVE-2026-24600
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Critical
CVE-2026-23550
Modular DS <= 2.5.1 - Unauthenticated Privilege Escalation
Medium
CVE-2025-10915
Dreamer Blog <= 1.2 - Missing Authorization
Medium
CVE-2026-24606
Bayarcash WooCommerce <= 4.3.12 - Missing Authorization
Medium
CVE-2025-15513
Float Payment Gateway <= 1.1.9 - Improper Authorization to Unauthenticated Order Status Manipulation
Medium
CVE-2026-0734
WP Allowed Hosts <= 1.0.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'allowed-hosts' Parameter
Medium
CVE-2026-0812
LinkedIn SC <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Page
High
CVE-2025-14770
Shipping Rate By Cities <= 2.0.0 - Unauthenticated SQL Injection via 'city' Parameter
Medium
CVE-2025-15376
Stopwords for comments <= 1.1 - Missing Authorization to Cross-Site Request Forgery
Medium
CVE-2026-0739
WMF Mobile Redirector <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
Medium
CVE-2026-0813
Short Link <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Administration Settings Page
Medium
CVE-2025-15512
Aplazo Payment Gateway <= 1.4.3 - Missing Authorization to Unauthenticated Order Status Manipulation
Medium
CVE-2025-15475
PayHere Payment Gateway Plugin for WooCommerce <= 2.3.9 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-0741
Electric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
Medium
CVE-2025-14846
SocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14173
Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
Medium
CVE-2026-0594
List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
Critical
CVE-2025-14502
News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion
High
CVE-2025-15378
AJS Footnotes <= 1.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-15377
Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery
High
CVE-2025-14615
DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection
High
CVE-2025-15283
Name Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
Critical
CVE-2025-14301
Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal
High
CVE-2025-15266
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.