Medium
CVE-2026-24540
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2026-24997
Wired Impact Volunteer Management <= 2.8 - Missing Authorization
Medium
CVE-2026-24544
HD Quiz <= 2.0.9 - Missing Authorization
High
CVE-2026-24390
Kentha Elementor Widgets < 3.1 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-24543
Materialis Companion <= 1.3.52 - Missing Authorization
Medium
CVE-2026-24996
WPElemento Importer <= 0.6.4 - Missing Authorization
High
CVE-2026-0911
Hustle <= 7.8.9.2 - Authenticated (Subscriber+) Arbitrary File Upoload via Module Import
Medium
CVE-2025-13920
WP Directory Kit <= 1.4.9 - Unauthenticated Email Exposure via wdk_public_action
Medium
CVE-2026-1300
Responsive Header Plugin <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
Medium
CVE-2025-13205
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Cloning
Medium
CVE-2025-13194
SurveyJS: Drag & Drop WordPress Form Builder to create, style and embed multiple forms of any complexity <= 2.5.2 - Cross-Site Request Forgery to Survey Renaming
Medium
CVE-2025-13139
SurveyJS: Drag & Drop WordPress Form Builder <= 2.5.2 - Cross-Site Request Forgery to Survey Creation
Medium
CVE-2026-1189
LeadBI Plugin for WordPress <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_id' Shortcode Attribute
Medium
CVE-2026-1208
Friendly Functions for Welcart <= 1.2.5 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2026-1127
Timeline Event History <= 3.2 - Reflected Cross-Site Scripting
Medium
CVE-2026-1191
JavaScript Notifier <= 1.2.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-24422
phpMyFAQ: Public API endpoints expose emails and invisible questions
Medium
CVE-2026-24421
phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing)
Medium
CVE-2026-24420
phpMyFAQ: Attachment download allowed without dlattachment right (broken access control)
Medium
CVE-2026-1266
Postalicious <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2026-1302
Meta-box GalleryMeta <= 3.0.1 - Authenticated (Editor+) Stored Cross-Site Scripting via Image Caption
Medium
CVE-2026-0687
Meta-box GalleryMeta <= 3.0.1 - Missing Authorization to Authenticated (Author+) Gallery Management
High
CVE-2026-0800
User Submitted Posts – Enable Users to Submit Posts from the Front End <= 20251210 - Unauthenticated Stored Cross-Site Scripting via Custom Field
Low
CVE-2026-0633
MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor <= 4.1.0 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.