Medium
CVE-2026-25018
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
High
CVE-2026-32482
Ona < 1.24 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2026-25401
WPCargo Track & Trace <= 8.0.2 - Missing Authorization
Medium
CVE-2026-32517
Contact Manager <= 9.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-25373
Vayvo < 6.8 - Reflected Cross-Site Scripting
High
CVE-2026-25032
Ricky < 2.31 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39483
VK All in One Expansion Unit <= 9.113.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-4389
DSGVO snippet for Leaflet Map and its Extensions <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'unset' Attribute
High
CVE-2026-32507
Leroux - Business Consulting WordPress Theme < 1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2026-39479
OttoKit <= 1.1.20 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2026-25398
Vertex Addons for Elementor <= 1.6.4 - Missing Authorization
High
CVE-2026-25400
Apicona <= 24.1.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-23979
Gyan Elements <= 2.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-24370
The Grid < 2.8.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-25357
Indeed Membership Pro <= 13.7 - Missing Authorization
Medium
CVE-2026-31914
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.26 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-25339
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-32491
WP Review Slider <= 13.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-40745
Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection
High
CVE-2026-25366
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.1 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-25406
Tutor LMS Pro <= 3.9.8 - Missing Authorization
Medium
CVE-2026-32562
PPWP – Password Protect Pages <= 1.9.15 - Missing Authorization
Medium
CVE-2026-39497
FOX <= 1.4.5 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-32533
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.