Medium
CVE-2026-6080
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 391
Reset filters
Medium
CVE-2025-53444
UserPro - Community and User Profile WordPress Plugin < 5.1.11 - Cross-Site Request Forgery
Medium
CVE-2026-4005
Coachific Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'userhash' Shortcode Attribute
High
CVE-2026-4352
JetEngine <= 3.8.6.1 - Unauthenticated SQL Injection via '_cct_search' Parameter
Medium
CVE-2026-3600
Investi <= 1.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'maximum-num-years' Shortcode Attribute
Medium
CVE-2026-2988
Blubrry PowerPress <= 11.15.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via powerpress and podcast Shortcodes
Medium
CVE-2026-3309
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Unauthenticated Arbitrary Shortcode Execution via Checkout Billing Fields
Medium
CVE-2026-4668
Amelia <= 2.1.2 - Authenticated (Manager+) SQL Injection via 'sort' Parameter
High
CVE-2026-4987
SureForms <= 2.5.2 - Unauthenticated Payment Amount Validation Bypass via 'form_id'
Medium
CVE-2026-4075
BWL Advanced FAQ Manager Lite <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sbox_id' Shortcode Attribute
Medium
CVE-2026-4072
WordPress PayPal Donation <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'amount' Shortcode Attribute
High
CVE-2026-1238
SlimStat Analytics <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via 'fh'
High
CVE-2026-27065
BuilderPress <= 2.0.1 - Unauthenticated Local File Inclusion
High
CVE-2026-22504
ProLingua <= 1.1.12 - Unauthenticated Local File Inclusion
Medium
CVE-2026-32430
PowerPack Addons for Elementor <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-28100
UberSlider PerpetuumMobile <= 2.3 - Reflected Cross-Site Scripting
High
CVE-2026-23798
PowerPress Podcasting plugin by Blubrry <= 11.15.10 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-1254
Modula Image Gallery – Photo Grid & Video Gallery <= 2.13.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post/Page Editing
Medium
CVE-2026-32351
PowerPress Podcasting <= 11.15.13 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-32353
MailerPress <= 1.4.2 - Authenticated (Contributor+) Server-Side Request Forgery
Critical
CVE-2026-2446
Powerpack for LearnDash <= 1.2.0 - Unauthenticated Arbitrary Options Update
Medium
CVE-2026-2295
WPZOOM Addons for Elementor – Starter Templates & Widgets <= 1.3.2 - Unauthenticated Protected Post Exposure via ajax_post_grid_load_more
Medium
CVE-2026-31917
ERP <= 1.16.10 - Authenticated (Crm agent+) SQL Injection
High
CVE-2025-68841
TopperPack – Complete Elementor Addons, Theme & CPT Builder <= 1.2.1 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.