Medium
CVE-2026-0950
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-0909
WP ULike <= 4.8.3.1 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Log Deletion via 'id' Parameter
Medium
CVE-2026-39585
Booktics <= 1.0.16 - Missing Authorization
High
CVE-2026-39538
Mikado Core <= 1.6 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25023
Run Contests, Raffles, and Giveaways with ContestsWP <= 2.0.7 - Unauthenticated Information Exposure
Medium
CVE-2026-25024
ThirstyAffiliates <= 3.11.9 - Cross-Site Request Forgery
High
CVE-2026-25326
CMSMasters Content Composer <= 1.4.5 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-25022
KiviCare <= 3.6.16 - Authenticated (Receptionist+) SQL Injection
Medium
CVE-2026-25325
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.8 - Unauthenticated Information Exposure
Medium
CVE-2026-39604
MyBookTable Bookstore <= 3.6.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-25324
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Unauthenticated Insecure Direct Object Reference
High
CVE-2026-23978
Gyan Elements <= 2.2.1 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-39603
Grand Photography <= 5.7.8 - Cross-Site Request Forgery
Medium
CVE-2026-1369
Conditional CAPTCHA <= 4.0.0 - Unauthenticated Open Redirect
Medium
CVE-2026-39602
Order Tracking <= 3.4.4 - Missing Authorization
Medium
CVE-2025-15525
Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure
Medium
CVE-2026-1431
Booking Calendar <= 10.14.13 - Missing Authorization to Unauthenticated Booking Details Exposure
Medium
CVE-2025-15510
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.8 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-25394
Fitness FSE <= 1.0.6 - Missing Authorization
Medium
CVE-2026-25020
WP Sync for Notion <= 1.7.0 - Missing Authorization
Medium
CVE-2026-25391
WP Wand – Unlimited Content Generation using AI – for OpenAI, Claude, Openrouter and Deepseek <= 1.3.07 - Missing Authorization
Medium
CVE-2026-0683
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.4.4 - Authenticated (Subscriber+) SQL Injection via Number Field Filter
Medium
CVE-2026-25021
Mizan Demo Importer <= 0.1.3 - Missing Authorization
Medium
CVE-2026-25399
Serious Slider <= 1.2.7 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.