Medium
CVE-2026-48868
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
Medium
CVE-2026-48874
GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress <= 7.8.7 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-48889
Booking for Appointments and Events Calendar – Amelia <= 2.3 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2026-27351
Employee, Leave and Recruitment Management System – Crew HRM <= 1.2.2 - Missing Authorization
High
CVE-2026-48885
HollerBox — Fast & Effective Popups & Lead-Generation <= 2.3.10.1 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2026-48875
JetSmartFilters <= 3.8.1 - Unauthenticated SQL Injection
Medium
CVE-2026-48881
TrueBooker – Appointment Booking and Scheduler System <= 1.1.9 - Missing Authorization
Medium
CVE-2026-48878
Visual Link Preview <= 2.4.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-5336
Dataverse Integration <= 2.90 - Authenticated (Contributor+) Server-Side Template Injection to Information Exposure
Medium
CVE-2026-49782
Elementor Website Builder – more than just a page builder <= 4.1.0 - Missing Authorization
Medium
CVE-2026-48964
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2026-48886
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Unauthenticated SQL Injection
Medium
CVE-2026-48882
WP Time Slots Booking Form <= 1.2.50 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2026-28116
Progress Planner <= 1.9.0 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-48880
WP Job Portal – AI-Powered Recruitment System for Company or Job Board website <= 2.5.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-48887
JS Help Desk – AI-Powered Support & Ticketing System <= 3.0.9 - Missing Authorization
Medium
CVE-2026-48870
King Addons for Elementor – 80+ Elementor Widgets, 4 000+ Elementor Templates, WooCommerce, Mega Menu, Popup Builder <= 51.1.62 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2026-40989
Spring Cloud Function Context has Uncontrolled Recursion
Medium
CVE-2026-40990
Spring Cloud Function Context: Uncontrolled Recursion is possible while attempting to add infinite amount of functions to Function Registry
Medium
CVE-2026-10281
Claw Orchestrator is missing authentication for the component API Endpoint
Medium
CVE-2026-5191
Tiled Gallery Carousel Without JetPack <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-title'
Medium
CVE-2026-4080
Easy Cart <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-2382
FPW Category Thumbnails <= 1.9.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'id' Parameter
Medium
CVE-2026-4081
ZeM STL <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.