Medium
CVE-2026-65534
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,089
Reset filters
Medium
CVE-2026-65488
LA-Studio Element Kit for Elementor <= 1.6.2 - Cross-Site Request Forgery
Medium
CVE-2026-65505
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Unauthenticated Information Exposure
Medium
CVE-2026-65503
Ultimate Store Kit – Addon For WooCommerce, EDD and Elementor <= 3.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-65480
TheGem <= 5.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-65484
Style Kits <= 2.6.5 - Missing Authorization
Medium
CVE-2026-65489
LA-Studio Element Kit for Elementor <= 1.6.2 - Missing Authorization
Medium
CVE-2026-65482
LA-Studio Element Kit for Elementor <= 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-59543
Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… <= 3.8.11 - Authenticated (Subscriber+) Remote Code Execution
Medium
CVE-2026-15787
Ultimate Addons for Elementor <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes
Medium
CVE-2026-15145
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fancy Text Widget
Medium
CVE-2026-1372
Tutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation
Medium
CVE-2026-15156
Essential Addons for Elementor <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reading Progress Global Color Settings
Medium
CVE-2026-14841
King Addons for Elementor <= 51.1.75 - Reflected XSS via Posts Grid Widget
Medium
CVE-2026-15385
RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-9734
W3SC Elementor to Zoho CRM <= 2.2.0 - Cross-Site Request Forgery to Settings Update
High
CVE-2026-61947
Form Vibes – Save Contact Form 7 & Elementor Form Entries to Database <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-13393
ElementsKit Lite <= 3.10.0 - Authenticated (Subsite administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-11390
News Kit Addons For Elementor <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Logo Title and Single Author Box Widgets
High
CVE-2026-15155
Essential Addons for Elementor <= 6.6.10 - Authenticated (Contributor+) Account Takeover via Email Header Injection
High
CVE-2026-13378
Form Vibes <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form 7 Form Field
Medium
CVE-2026-12141
Premium Addons for Elementor <= 4.11.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'premium_tooltip_text' Parameter
High
CVE-2026-15338
LA-Studio Element Kit for Elementor <= 1.6.1 - Authenticated (Contributor+) Local File Inclusion via 'progress_type' Widget Setting
High
CVE-2026-57708
Database for Contact Form 7, WPforms, Elementor forms <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.