Medium
CVE-2026-0691
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-68872
Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting
Medium
CVE-2025-12984
Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection
Critical
CVE-2025-10484
Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass
Medium
CVE-2025-67942
Peach Payments Gateway <= 3.3.6 - Missing Authorization
High
CVE-2025-67940
Powerlift < 3.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68871
Dooodl <= 2.3.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-68849
Quote Master <= 7.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-31413
Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
Medium
CVE-2026-24386
Element Invader – Template Kits for Elementor <= 1.2.4 - Missing Authorization
Medium
CVE-2025-68008
Mail <= 1.3 - Reflected Cross-Site Scripting
High
CVE-2025-14844
Membership Plugin – Restrict Content <= 3.2.16 - Missing Authentication to Insecure Direct Object Reference and Sensitive Information Exposure
Medium
CVE-2025-14757
Cost Calculator Builder <= 3.6.9 - Missing Authorization to Unauthenticated Payment Status Bypass
Medium
CVE-2026-1004
Essential Addons for Elementor <= 6.5.5 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14375
RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging <= 5.0.10 - Reflected Cross-Site Scripting via className
Medium
CVE-2025-14853
LEAV Last Email Address Validator <= 1.7.1 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2026-0916
Related Posts by Taxonomy <= 2.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'related_posts_by_tax' Shortcode
Medium
CVE-2025-14793
DK PDF – WordPress PDF Generator <= 2.3.0 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2026-0942
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion
Medium
CVE-2026-0939
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation
High
CVE-2025-12957
All-in-One Video Gallery <= 4.5.7 - Authenticated (Author+) Arbitrary File Upload via VTT Upload Bypass
Medium
CVE-2025-14384
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
Medium
CVE-2025-14982
Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-15370
Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.