Medium
CVE-2026-48880
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-48887
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization
Medium
CVE-2026-48870
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-5191
Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'
Medium
CVE-2026-4080
Easy Cart <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-2382
FPW Category Thumbnails <= 1.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter
Medium
CVE-2026-4081
ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-4071
BirdSeed <= 2.2.0 - Cross-Site Request Forgery via BirdSeed Token Change
Medium
CVE-2026-3620
Word Replacer <= 0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Replacement' Parameter
Medium
CVE-2026-2425
hiWeb Migration Simple <= 2.0.0.1 - Reflected Cross-Site Scripting via 'new_domain' Parameter
Medium
CVE-2026-1451
rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'a' Parameter
Medium
CVE-2026-1450
rognone <= 0.6.2 - Reflected Cross-Site Scripting via 'mode' Parameter
Medium
CVE-2025-5085
wp-nano-ad <= 1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter
Medium
CVE-2026-8885
DeMomentSomTres Shortcodes <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-9730
Remove NoFollow Commenter URL <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-9723
Google Plus One Bottom <= 0.0.2 - Cross-Site Request Forgery to Plugin Settings Update via Settings Page
Medium
CVE-2026-9722
Laiser Tag <= 1.2.5 - Cross-Site Request Forgery to Plugin Settings Update via Settings Form
Medium
CVE-2026-9234
JTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions
Medium
CVE-2026-9599
Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-8422
Remove meta boxes per user role <= 1.01 - Cross-Site Request Forgery to Settings Update
Critical
CVE-2026-8206
Kirki 6.0.0 - 6.0.6 - Unauthenticated Privilege Escalation via 'handle_forgot_password'
Medium
CVE-2026-10100
Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2026-3722
Auto Image Attributes From Filename With Bulk Updater (Add Alt Text, Image Title For Image SEO) <= 4.9 - Authenticated (Author+) Stored Cross-Site Scripting via Image Attribute
Medium
CVE-2026-9050
Slider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.