Medium
CVE-2025-14042
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-6275
StatCounter <= 2.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via Author Nickname
Medium
CVE-2026-9714
Simple Divi Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute
Critical
CVE-2026-8732
WP Maps Pro <= 6.1.0 - Unauthenticated Privilege Escalation via Administrator Account Creation to wpgmp_temp_access_ajax AJAX Action
High
CVE-2025-11993
WooCommerce Infinite Scroll and Ajax Pagination <= 1.8 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-2128
Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie
Critical
CVE-2026-4290
WP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators
Medium
CVE-2026-7430
Post Snippets <= 4.0.19 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import
Medium
CVE-2026-8995
Poll Maker by AYS <= 6.3.7 - Authenticated (Subscriber+) Sensitive Information Exposure in 'ays_poll_get_user_information' AJAX Action
Critical
CVE-2026-8809
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
Medium
CVE-2026-42742
Views for WPForms – Display & Edit WPForms Entries on your site frontend <= 3.4.6 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2026-9815
MagicForm <= 0.1.3 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-42741
Ninja Forms Views – Display & Edit Ninja Forms Submissions on your site frontend <= 3.3.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2026-42744
Quads Ads Manager for Google AdSense <= 3.0.2 - Missing Authorization
High
CVE-2026-27333
Paid Videochat Turnkey Site – HTML5 PPV Live Webcams <= 7.3.23 - Unauthenticated PHP Object Injection
High
CVE-2026-27407
AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.4.9 - Authenticated (Editor+) Privilege Escalation
High
CVE-2025-69151
Grand Car Rental | Limousine HTML Template <= 3.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-42411
CloudSecure WP Security <= 1.4.7 - Two-Factor Authentication Bypass
Medium
CVE-2026-48835
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.10.0.4 - Missing Authorization
Medium
CVE-2026-42745
Smart Online Order for Clover <= 1.6.0 - Missing Authorization
High
CVE-2026-48838
Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App <= 3.6.2 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-39447
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.10.6 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42739
Advanced IP Blocker <= 8.10.7 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-42740
Tainacan <= 1.0.3 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.