Medium
CVE-2025-68859
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Critical
CVE-2026-23800
Modular DS 2.5.2 - Unauthenticated Privilege Escalation
Medium
CVE-2026-25005
Frontend File Manager Plugin <= 23.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-68016
onepay Payment Gateway For WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-0691
CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter
Medium
CVE-2025-68872
Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting
Medium
CVE-2025-12984
Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection
Critical
CVE-2025-10484
Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass
Medium
CVE-2025-67942
Peach Payments Gateway <= 3.3.6 - Missing Authorization
High
CVE-2025-67940
Powerlift < 3.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68871
Dooodl <= 2.3.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-68849
Quote Master <= 7.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-31413
Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
Medium
CVE-2026-24386
Element Invader – Template Kits for Elementor <= 1.2.4 - Missing Authorization
Medium
CVE-2025-68008
Mail <= 1.3 - Reflected Cross-Site Scripting
High
CVE-2025-14844
Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure
Medium
CVE-2025-14757
Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
Medium
CVE-2026-1004
Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14375
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className
Medium
CVE-2025-14853
LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-0916
Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode
Medium
CVE-2025-14793
DK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2026-0942
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion
Medium
CVE-2026-0939
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.