Medium
CVE-2026-0950
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 391
Reset filters
Medium
CVE-2025-15525
Ajax Load More – Infinite Scroll, Lazy Load & Load More <= 7.8.1 - Incorrect Authorization to Unauthenticated Private/Draft Post Title and Excerpt Exposure
Medium
CVE-2025-68838
MemberPress Discord Addon <= 1.1.4 - Reflected Cross-Site Scripting
High
CVE-2025-15057
SlimStat Analytics <= 5.3.3 - Unauthenticated Stored Cross-Site Scripting via 'fh' Parameter
Medium
CVE-2025-68892
Scroll rss excerpt <= 5.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-68608
Userpro <= 5.1.9 - Missing Authorization
Medium
CVE-2025-14080
Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification
Medium
CVE-2025-12885
Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13608
CC Child Pages <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'child_pages' Shortcode
Medium
CVE-2025-63008
ERP <= 1.16.7 - Missing Authorization
Medium
CVE-2025-67546
ERP <= 1.16.6 - Authenticated (Subscriber+) Information Exposure
High
CVE-2025-13536
Blubrry PowerPress <= 11.15.2 - Authenticated (Contributor+) Arbitrary File Upload via 'powerpress_edit_post'
High
CVE-2026-15291
Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
High
CVE-2025-12846
Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
An arbitrary file upload vulnerability in the Blocksy Companion plugin for WordPress allows authenticated attackers with author-level permissions or higher to upload arbitrary files, potentially leading to remote code execution.
High
CVE-2025-10487
Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution
High
CVE-2025-4203
wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
Medium
CVE-2025-64201
PowerPress Podcasting <= 11.13.12 - Cross-Site Request Forgery
High
CVE-2025-11691
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection
An unauthenticated SQL injection vulnerability in PPOM for WooCommerce allows attackers to extract sensitive database information when Legacy Price Calculations are enabled.
Critical
CVE-2025-11391
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
A vulnerability in PPOM – Product Addons & Custom Fields for WooCommerce allows unauthenticated attackers to upload arbitrary files via the image cropper, potentially enabling remote code execution on sites with the paid version active.
Medium
CVE-2025-9946
LockerPress – WordPress Security Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-10128
Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-60099
Embed Any Document <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58223
VoucherPress <= 1.5.7 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2025-9693
User Meta – User Profile Builder and User management plugin <= 3.1.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.