Medium
CVE-2026-25398
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2026-25400
Apicona <= 24.1.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2026-23979
Gyan Elements <= 2.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2026-24370
The Grid < 2.8.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-25357
Indeed Membership Pro <= 13.7 - Missing Authorization
Medium
CVE-2026-31914
WP Courses LMS – Online Courses Builder, eLearning Courses, Courses Solution, Education Courses <= 3.2.26 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-25339
WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More <= 1.9.8.7 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-32491
WP Review Slider <= 13.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-40745
Element Pack Elementor Addons <= 8.4.2 - Authenticated (Editor+) SQL Injection
High
CVE-2026-25366
Woody Code Snippets – Insert PHP, CSS, JS, and Header/Footer Scripts <= 2.7.1 - Authenticated (Contributor+) Remote Code Execution
Medium
CVE-2026-25406
Tutor LMS Pro <= 3.9.8 - Missing Authorization
Medium
CVE-2026-32562
PPWP – Password Protect Pages <= 1.9.15 - Missing Authorization
Medium
CVE-2026-39497
FOX <= 1.4.5 - Authenticated (Shop manager+) SQL Injection
Medium
CVE-2026-32533
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-25397
File Uploader for WooCommerce <= 1.0.4 - Unauthenticated Path Traversal
Medium
CVE-2026-32485
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization
Medium
CVE-2026-39500
themesflat-addons-for-elementor <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-25034
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.16 - Missing Authorization
High
CVE-2026-32506
Archicon < 1.7 - Unauthenticated PHP Object Injection
High
CVE-2026-32544
OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.62 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-25376
Addon Jobsearch Chat <= 3.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-25355
Sanzo < 2.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2026-25358
Meloo < 2.8.2 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2026-32508
Halstein < 1.8 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.