Medium
CVE-2026-24568
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-24571
BOX NOW Delivery <= 3.0.2 - Missing Authorization
Critical
CVE-2025-15521
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2026-0690
FlatPM – Ad Manager, AdSense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta
Medium
CVE-2026-0608
Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
High
CVE-2026-0726
Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'
Medium
CVE-2026-0554
NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset
High
CVE-2025-15380
NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview'
High
CVE-2025-15347
Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Medium
CVE-2026-0548
Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
Medium
CVE-2025-15043
The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
Medium
CVE-2025-68838
MemberPress Discord Addon <= 1.1.4 - Reflected Cross-Site Scripting
High
CVE-2025-67952
Grand Tour < 5.6.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2026-22337
Directorist Social Login <= 2.1.1 - Unauthenticated Privilege Escalation
High
CVE-2025-24648
Admin and Site Enhancements (ASE) <= 7.6.2.1 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-68882
Scalenut <= 1.1.3 - Missing Authorization
High
CVE-2025-67944
Nelio AB Testing <= 8.1.8 - Authenticated (Editor+) Remote Code Execution
Medium
CVE-2025-68835
Ravpage <= 2.40 - Reflected Cross-Site Scripting
Medium
CVE-2025-68858
wpCAS <= 1.07 - Reflected Cross-Site Scripting
Medium
CVE-2026-24577
Pie Register <= 3.8.4.8 - Missing Authorization
Critical
CVE-2025-67953
Booking Activities <= 1.16.44 - Unauthenticated Privilege Escalation
High
CVE-2026-22850
Koko Analytics <= 2.1.2 - Unauthenticated SQL Injection
High
CVE-2025-67945
MailerLite – WooCommerce integration <= 3.1.2 - Unauthenticated SQL Injection
Medium
CVE-2026-24575
WishList Member X <= 3.32.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.