Medium
CVE-2026-3645
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-2351
Task Manager <= 3.0.2 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2026-4072
WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute
Medium
CVE-2026-3996
WP Games Embed <= 0.1beta - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-2375
App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter
High
CVE-2026-2941
Linksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details
Medium
CVE-2026-4083
Scoreboard for HTML5 Games Lite <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-3474
EmailKit <= 1.6.3 - Authenticated (Administrator+) Path Traversal via 'emailkit-editor-template' REST API Parameter
Medium
CVE-2026-3350
Image Alt Text Manager <= 1.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via Post Title
High
CVE-2026-25359
Pendulum < 3.1.5 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-32499
WPBot – AI ChatBot for Live Support, Lead Generation, AI Services <= 7.7.9 - Unauthenticated SQL Injection
High
CVE-2026-32531
Kunco < 1.4.5 - Unauthenticated Local File Inclusion
High
CVE-2026-32504
VintWood <= 1.1.8 - Unauthenticated Local File Inclusion
High
CVE-2026-32500
MetaMax <= 1.1.4 - Unauthenticated Local File Inclusion
Medium
CVE-2026-2430
Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
Medium
CVE-2026-32534
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.3 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-25382
IdealAuto < 3.8.6 - Unauthenticated Local File Inclusion
Medium
CVE-2026-3567
RepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action
Medium
CVE-2026-32519
Bit SMTP – Easy SMTP Solution with Email Logs <= 1.2.2 - Missing Authorization
High
CVE-2026-25360
Vex < 1.2.9 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-32538
SMTP Mailer <= 1.1.24 - Unauthenticated Information Exposure
High
CVE-2026-32513
JS Archive List <= 6.1.7 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2026-25381
LoveDate < 3.8.6 - Unauthenticated Local File Inclusion
High
CVE-2026-25379
StreamVid < 6.8.6 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.