Medium
CVE-2026-25005
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-68016
onepay Payment Gateway For WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-0691
CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter
Medium
CVE-2025-68872
Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting
Medium
CVE-2025-12984
Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection
Critical
CVE-2025-10484
Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass
Medium
CVE-2025-67942
Peach Payments Gateway <= 3.3.6 - Missing Authorization
High
CVE-2025-67940
Powerlift < 3.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68871
Dooodl <= 2.3.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-68849
Quote Master <= 7.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-31413
Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
Medium
CVE-2026-24386
Element Invader – Template Kits for Elementor <= 1.2.4 - Missing Authorization
Medium
CVE-2025-68008
Mail <= 1.3 - Reflected Cross-Site Scripting
Low
ghsa-rwr8-xrpw-9qf5
solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets
Low
ghsa-44jg-mv3h-wj6g
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
High
CVE-2026-22775
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
Medium
CVE-2026-1002
Vert.x Web static handler component cache can be manipulated to deny the access to static files
High
CVE-2025-14844
Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure
Medium
CVE-2025-14757
Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
Low
CVE-2026-23634
Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode
Medium
CVE-2025-15265
svelte vulnerable to Cross-site Scripting
Low
ghsa-58q2-9x27-h2jm
solspace/craft-freeform Has a DoS Vulnerability
High
CVE-2026-23622
alextselegidis/easyappointments is Vulnerable to CSRF Protection Bypass
High
CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.