Medium
CVE-2026-25319
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2026-25015
UsersWP <= 1.2.53 - Cross-Site Request Forgery
High
CVE-2025-69367
Oyster - Photography WordPress <= 4.4.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-67978
Educare <= 1.6.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-0844
Simple User Registration <= 6.7 - Authenticated (Subscriber+) Privilege Escalation via profile_save_field
High
CVE-2026-1280
Frontend File Manager Plugin <= 23.5 - Missing Authorization to Unauthenticated Arbitrary File Sharing via 'file_id' Parameter
Medium
CVE-2026-1380
Bitcoin Donate Button <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1391
Vzaar Media Management <= 1.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2026-1377
imwptip <= 1.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-14616
Recooty <= 1.0.6 - Cross-Site Request Forgery to Settings Update
High
CVE-2026-15298
TelSender <= 1.14.14 - Unauthenticated Stored Cross-Site Scripting via Telegram Chat Title
Medium
CVE-2026-1398
Change WP URL <= 1.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1399
WP Google Ad Manager Plugin <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Admin Settings
Medium
CVE-2025-15511
Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2025-14063
SEO Links Interlinking <= 1.7.9.9.1 - Reflected Cross-Site Scripting via 'google_error' Parameter
Medium
CVE-2025-14283
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-14386
Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization 2.4.4 - 2.5.15 - Missing Authorization to Authenticated (Subscriber+) Authentication Bypass via Account Takeover
Medium
CVE-2026-1381
Order Minimum/Maximum Amount Limits for WooCommerce <= 4.6.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via Hide Add to Cart Content Fields
Medium
CVE-2026-1053
Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters
High
CVE-2026-1400
AI Engine <= 3.3.2 - Authenticated (Editor+) Arbitrary File Upload via 'filename' Parameter in update_media_metadata Endpoint
Medium
CVE-2026-1389
Document Embedder <= 2.0.4 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Document Library Entry Deletion
Medium
CVE-2026-1054
RegistrationMagic <= 6.0.7.4 - Missing Authorization to Unauthenticated Arbitrary Settings Modification
Medium
CVE-2026-1310
Simple calendar for Elementor <= 1.6.6 - Missing Authorization to Unauthenticated Arbitrary Calendar Entry Deletion
Medium
CVE-2025-12709
Interactions – Create Interactive Experiences in the Block Editor <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.