Medium
CVE-2026-24580
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-69314
Werkstatt < 4.8.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-69311
Broadstreet Ads <= 1.52.1 - Missing Authorization
Medium
CVE-2026-25307
XStore Core < 5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-25008
Ninja Tables – Easy Data Table Builder <= 5.2.5 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2026-25305
XStore <= 9.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-25006
XStore <= 9.6.4 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2026-24587
AJAX Hits Counter + Popular Posts Widget <= 0.10.210305 - Missing Authorization
Medium
CVE-2026-25459
Sober <= 3.5.12 - Missing Authorization
Medium
CVE-2026-24585
Hyyan WooCommerce Polylang Integration <= 1.5.0 - Missing Authorization
Medium
CVE-2026-24588
Smart Product Viewer <= 1.5.4 - Missing Authorization
Medium
CVE-2026-24984
Visual Link Preview <= 2.2.9 - Missing Authorization
Medium
CVE-2026-24982
Spectra <= 2.19.17 - Missing Authorization
Medium
CVE-2026-24355
Houzez Theme - Functionality <= 4.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-69300
Premium Addons for Elementor <= 4.11.63 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2026-25463
Wpresidence Core <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-24589
Cargus <= 1.5.8 - Unauthenticated Information Exposure
Medium
CVE-2025-14078
PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation
Medium
CVE-2026-0725
Integrate Dynamics 365 CRM <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration
Medium
CVE-2025-8615
CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
Medium
CVE-2025-12129
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure
Medium
CVE-2026-0808
Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
Medium
CVE-2026-0833
Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link
Medium
CVE-2025-14029
Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.