Medium
CVE-2026-1097
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-13676
JustClick registration plugin <= 0.1 - Reflected Cross-Site Scripting via PHP_SELF
Medium
CVE-2025-14843
Wizit Gateway for WooCommerce <= 1.3.1 - Missing Authentication to Unauthenticated Arbitrary Order Cancellation
Medium
CVE-2026-1081
Set Bulk Post Categories <= 1.1 - Cross-Site Request Forgery to Bulk Post Category Update
Medium
CVE-2026-1070
Alex User Counter <= 6.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-14985
Alpha Blocks <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'alpha_block_css' Post Meta
Medium
CVE-2026-1076
Star Review Manager <= 1.2.2 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1099
Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'login' and 'logout' Shortcode Attributes
High
CVE-2026-1257
Administrative Shortcodes <= 0.3.4 - Authenticated (Contributor+) Local File Inclusion via 'slug' Shortcode Attribute
High
CVE-2026-0807
Frontis Blocks <= 1.1.6 - Unauthenticated Server-Side Request Forgery via 'url' Parameter
Medium
CVE-2026-1084
Cookie consent for developers <= 1.7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Multiple Settings Fields
Medium
CVE-2026-1075
ZT Captcha <= 1.0.4 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1103
AIKTP <= 5.0.04 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
Medium
CVE-2025-14609
Wise Analytics <= 1.1.9 - Missing Authorization to Unauthenticated Arbitrary Analytics Database Disclosure via 'name' Parameter
Medium
CVE-2025-14906
WP Youtube Video Gallery <= 1.0 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14629
Alchemist Ajax Upload <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Media File Deletion
Medium
CVE-2025-14797
Same Category Posts <= 1.1.19 - Authenticated (Author+) Stored Cross-Site Scripting via Widget Title Placeholder
Medium
CVE-2025-14903
Simple Crypto Shortcodes <= 1.0.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-12836
VK Google Job Posting Manager <= 1.2.23 - Authenticated (Author+) Stored Cross-Site Scripting via Job Description Field
Critical
CVE-2025-13374
Kalrav AI Agent <= 2.3.8 - Unauthenticated Arbitrary File Upload via kalrav_upload_file AJAX Action
Medium
CVE-2026-24549
GeoDirectory <= 2.8.149 - Cross-Site Request Forgery
Medium
CVE-2026-25441
LeadConnector <= 3.0.21 - Missing Authorization
Medium
CVE-2025-15520
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.7.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-68999
Happy Addons for Elementor <= 3.20.4 - Authenticated (Contributor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.