Medium
CVE-2026-24541
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2026-24379
Job Portal <= 2.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2026-24390
Kentha Elementor Widgets < 3.1 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2026-0911
Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
Medium
CVE-2025-13920
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
High
CVE-2026-1257
Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute
Medium
CVE-2026-1103
AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
Critical
CVE-2025-13374
Kalrav AI Agent <= 2.3.8 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action
High
CVE-2025-69294
PeakShops <= 1.5.9 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-1251
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) Insecure Direct Object Reference
High
CVE-2025-69322
PeakShops < 1.5.9 - Unauthenticated Local File Inclusion
Medium
CVE-2025-14745
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via wp-rss-aggregator Shortcode
Medium
CVE-2025-15522
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.10.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-68047
Eventin <= 4.1.3 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-69188
Fitness Trainer <= 1.7.1 - Missing Authorization
Medium
CVE-2025-13921
weDocs <= 2.1.16 - Missing Authorization to Authenticated (Subscriber+) Documentation Post Update
Medium
CVE-2025-14947
All-in-One Video Gallery <= 4.6.4 - Missing Authorization to Unauthenticated Bunny Stream Video Creation/Deletion
Critical
CVE-2025-14892
Prime Listing Manager <= 1.1 - Unauthenticated Privilege Escalation via Account Takeover
Critical
CVE-2026-0920
LA-Studio Element Kit for Elementor <= 1.5.6.3 - Unauthenticated Privilege Escalation via Backdoor to Administrative User Creation via lakit_bkrole parameter
Medium
CVE-2026-1036
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion
High
CVE-2025-67957
Listivo Core <= 2.3.77 - Unauthenticated Local File Inclusion
High
CVE-2026-22338
EcoBlue <= 1.15 - Unauthenticated Local File Inclusion
High
CVE-2025-68857
Paid Downloads <= 3.15 - Unauthenticated SQL Injection
High
CVE-2026-1235
eCommerce <= 3.15.1 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.