Medium
CVE-2026-40780
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2025-58922
Avada < 7.13.2 - Cross-Site Request Forgery
Medium
CVE-2026-25440
Essential Addons for Elementor – Popular Elementor Templates & Widgets < 6.6.0 - Missing Authorization
High
CVE-2026-39442
PressMart <= 1.2.26 - Unauthenticated PHP Object Injection
Medium
CVE-2026-40783
Blocksy Companion Pro <= 2.1.37 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-40782
WPAdverts – Classifieds Plugin <= 2.3.0 - Missing Authorization
High
CVE-2026-39445
Alukas < 3.0.0 - Unauthenticated PHP Object Injection
High
CVE-2026-40779
Link Library <= 7.8.8 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2026-39441
Feed KuantoKusta for WooCommerce – Free <= 5.3 - Unauthenticated SQL Injection
High
CVE-2026-39446
Kapee < 1.7.0 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39450
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.7.3 - Missing Authorization
Medium
CVE-2026-22751
Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Low
CVE-2026-6745
Bagisto affected by Cross-site Scripting
Low
CVE-2026-6744
Bagisto affected by Server-Side Request Forgery
Medium
CVE-2026-41067
Astro: XSS in define:vars via incomplete </script> tag sanitization
Medium
CVE-2026-1395
Gutentools <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Slider Block Attributes
Medium
CVE-2026-1913
Gallagher Website Design <= 2.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'prefix' Shortcode Attribute
Medium
CVE-2026-1930
Emailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion
Critical
CVE-2026-41264
Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability
Medium
CVE-2026-3362
Short Comment Filter <= 2.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Minimum Count' Setting
Medium
CVE-2026-2719
Private WP suite <= 0.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Exceptions' Setting
Medium
CVE-2026-1845
Real Estate Pro <= 1.0.9 - Authenticated (Admin+) Stored Cross-Site Scripting via Settings
High
CVE-2026-4132
HTTP Headers <= 1.19.2 - Authenticated (Administrator+) External Control of File Name or Path to RCE via 'hh_htpasswd_path' and 'hh_www_authenticate_user' Parameters
Medium
CVE-2026-2717
HTTP Headers <= 1.19.5 - Authenticated (Administrator+) CRLF Injection via Custom Header Values
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.