Medium
CVE-2026-14183
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-69153
Trendy Travel <= 6.7 - Reflected Cross-Site Scripting
High
CVE-2026-11767
CRT Addons for Elementor <= 1.6.6 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-69152
Artale | Wedding Photography WordPress <= 2.2.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57670
CodePeople Post Map for Google Maps <= 1.2.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-69132
Corpkit - Business Consulting WordPress Theme <= 1.0.5 - Authenticated (Subscriber+) Sensitive Information Exopsure
Medium
CVE-2026-14185
WPBot AI ChatBot <= 8.1.0 - Missing Authorization
High
CVE-2026-57673
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-69154
SpaLab | Beauty Salon WordPress <= 6.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57672
wpDataTables (Premium) <= 6.5.1.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-57674
Timetics – Appointment Booking Calendar & Scheduling System <= 1.0.58 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-69156
Kids Zone - Children WordPress <= 5.4 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-8082
Bpost Shipping Platform <= 3.2.2 - Unauthenticated SQL Injection
High
CVE-2026-8141
Ajax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' Field
Critical
CVE-2026-9711
EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter
High
CVE-2026-12240
Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Field
Critical
CVE-2026-12073
ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite
Medium
CVE-2026-12560
Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field
Medium
CVE-2026-12349
Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions
Medium
CVE-2026-11367
PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameter
Medium
CVE-2026-8944
Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameter
Medium
CVE-2026-12114
Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameter
High
CVE-2026-11349
Modern Events Calendar (Lite & Pro) <= 7.33.0 - Unauthenticated SQL Injection
Medium
CVE-2026-12724
Kirki <= 6.0.11 - Unauthenticated HTML Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.