Medium
347feeaa-2d5c-4818-ab9e-2125a00b8ae8
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
0114a028-42ef-4668-815f-d62494565116
The Plus Addons for Elementor – Addons for Elementor, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2026-6279
Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler
Critical
CVE-2026-5118
Divi Form Builder <= 5.1.2 - Unauthenticated Privilege Escalation via 'role'
Medium
CVE-2026-24573
Visualizer: Tables and Charts Manager for WordPress < 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2026-5200
AcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'
Medium
CVE-2026-6405
Anomify AI <= 0.3.6 - Cross-Site Request Forgery
Medium
CVE-2026-2955
AI Chatbot & Workflow Automation by AIWU <= 1.4.14 - Unauthenticated Stored Cross-Site Scripting via 'X-Forwarded-For' Header
High
CVE-2026-7522
Advanced Database Cleaner – Premium <= 4.1.0 - Authenticated (Subscriber+) Local File Inclusion via 'template'
Medium
CVE-2026-5075
All in One SEO <= 4.9.7 - Authenticated (Contributor+) Sensitive Information Exposure via 'internalOptions' Localized Script Data
Critical
CVE-2026-7637
Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie
Critical
CVE-2026-7284
Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register
High
CVE-2026-3985
Creative Mail – Easier WordPress & WooCommerce Email Marketing <= 1.6.9 - Unauthenticated SQL Injection via 'checkout_uuid' Parameter
High
CVE-2026-7467
Read More & Accordion <= 3.5.7 - Privilege Escalation via importData
Medium
CVE-2026-6404
Anomify AI <= 0.3.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'anomify_api_key' Parameter
Medium
CVE-2026-6401
Bottom Bar <= 0.1.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-6397
Sticky <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'readmoretext' Shortcode Attribute
Medium
CVE-2026-6394
Nexa Blocks <= 1.1.1 - Unauthenticated Blind Server-Side Request Forgery via 'demo_json_file' Parameter
Medium
CVE-2026-6072
Oliver POS <= 2.4.2.6 - Unauthenticated Authorization Bypass Through User-Controlled Key to 'OliverAuth' Header
Medium
CVE-2026-5293
診断ジェネレータ作成プラグイン <= 1.4.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'js' Parameter
Medium
CVE-2026-8096
Kirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action
High
CVE-2026-3430
Creative Mail <= 1.6.9 - Unauthenticated SQL Injection
Medium
CVE-2026-4986
WPForms Lite <= 1.10.0.4 - Unauthenticated Payment Bypass
Medium
CVE-2026-42679
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.3.8 - Authenticated (Subscriber+) Arbitrary File Download
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.