Medium
CVE-2025-68839
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-68518
Hoteller < 6.8.9 - Reflected Cross-Site Scripting
High
CVE-2025-67946
AdForest <= 6.0.11 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68538
Craft <= 2.3.6 - Reflected Cross-Site Scripting
Medium
CVE-2026-24578
Admin login URL Change <= 1.1.5 - Missing Authorization
Medium
CVE-2026-24986
Simple Membership WP user Import <= 1.9.1 - Cross-Site Request Forgery
Medium
CVE-2025-68840
iRobots.txt SEO <= 1.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-69315
Simply Schedule Appointments <= 1.6.9.15 - Missing Authorization
High
CVE-2026-22336
Directorist Booking <= 2.4.1 - Unauthenticated SQL Injection
Medium
CVE-2025-68046
Contact Form & Lead Form Elementor Builder <= 2.0.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-68020
WANotifier <= 2.7.13 - Missing Authorization
Critical
CVE-2025-14533
Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action
Medium
CVE-2026-1042
WP Hello Bar <= 1.02 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'digit_one' and 'digit_two' Parameters
Medium
CVE-2026-1045
Viet contact <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'll1', 'll2', 'll3', and 'll4' Parameters
Medium
CVE-2025-14348
weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure
High
CVE-2025-14977
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
Medium
CVE-2025-14351
Custom Fonts – Host Your Fonts Locally <= 2.1.16 - Missing Authorization to Unauthenticated Font Deletion
Medium
CVE-2025-14798
LearnPress – WordPress LMS Plugin <= 4.3.2.4 - Missing Authorization to Unauthenticated Sensitive User Information Disclosure via REST API
Medium
CVE-2025-14978
PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) <= 1.119.8 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-1051
Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription
Medium
CVE-2025-15466
Image Photo Gallery Final Tiles Grid <= 3.6.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Gallery Management
Medium
CVE-2025-59355
Apache Linkis: Password Exposure
High
CVE-2025-29847
Apache Linkis: Arbitrary File Read via Double URL Encoding Bypass
Medium
CVE-2026-25453
Advanced iFrame <= 2025.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.