Medium
CVE-2026-1279
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-1888
Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-1909
WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
Medium
CVE-2026-1808
Orange Confort+ accessibility toolbar for WordPress <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-10753
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.14 - Missing Authorization
Medium
CVE-2026-1228
Timeline Block <= 1.3.3 - Insecure Direct Object Reference to Authenticated (Author+) Private Timeline Exposure via Shortcode Attribute
Medium
CVE-2026-1927
GreenShift - Animation and Page Builder Blocks <= 12.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure of AI API Keys and Stored Cross-Site Scripting via custom_css
Critical
CVE-2025-69376
User Extra Fields <= 17.0 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2026-23974
Golo < 1.7.5 - Missing Authorization
Medium
CVE-2026-31918
immonex Kickstart <= 1.13.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-1401
Tune Library <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via CSV Import
High
CVE-2026-23975
Golo < 1.7.5 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-68542
Checkout Gateway for IRIS <= 1.3 - Missing Authorization
Medium
CVE-2025-68852
Court Reservation <= 1.10.8 - Reflected Cross-Site Scripting
Medium
CVE-2026-31917
ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection
Critical
CVE-2025-68043
LottieFiles <= 3.0.0 - Missing Authorization
Medium
CVE-2025-68032
Advanced WC Analytics <= 3.19.0 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-68863
iContact for Gravity Forms <= 1.3.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-25028
ElementInvader Addons for Elementor <= 1.4.1 - Missing Authorization
High
CVE-2025-69375
Portfolio Builder <= 1.2.5 - Unauthenticated Local File Inclusion
Medium
CVE-2026-39607
Filter Plus <= 1.1.17 - Missing Authorization
Medium
CVE-2025-68851
Okay Toolkit <= 2.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-68025
Addonify Floating Cart For WooCommerce <= 1.2.17 - Missing Authorization
High
CVE-2025-67988
CozyStay < 1.9.1 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.