Skip to main content
Skip to footer
Opens in a new tab
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Home
CVE Analysis
How it Works
Resources
Pricing
Log in
Create Account
Severity:
medium
CVE-2025-69392: iMoney <= 0.36 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69392 affects the iMoney WordPress plugin (up to version 0.36) with a medium severity CVSS score of 6.1. Users should…
CVE-2025-69401: WooODT Lite <= 2.5.2 Unauthenticated Payment Bypass PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69401 affects the Byconsole Woo Order Delivery Time plugin (up to v2.5.2) with a medium severity score of 5.3. Unauthenticated…
CVE-2025-15400: OpenPix <= 2.13.3 Missing Authorization to Authenticated (Subscriber+) Settings Update PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-15400 affects the OpenPix for WooCommerce plugin (up to v2.13.3) with a medium severity (CVSS 4.3) vulnerability allowing unauthorized actions…
CVE-2026-22350: PDF for Elementor Forms + Drag And Drop Template Builder <= 6.3.1 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-22350 affects the PDF for Elementor Forms plugin (up to v6.3.1) with a medium severity (CVSS 4.3) vulnerability. Update to…
CVE-2025-68534: PDF for WPForms <= 6.3.0 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-68534 affects the PDF for WPForms plugin (up to v6.3.0) with a medium severity CVSS score of 4.3. Authenticated attackers…
CVE-2025-69063: New User Approve <= 3.2.0 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-69063 affects the New User Approve plugin for WordPress, versions up to 3.2.0, with a medium severity CVSS score of…
CVE-2026-22351: FullCalendar <= 1.6 Missing Authorization PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-22351 affects the Wp Fullcalendar plugin (up to version 1.6) with a medium severity score of 5.3. Unauthenticated attackers can…
CVE-2025-68514: Paid Member Subscriptions <= 2.16.8 Authenticated (Subscriber+) Insecure Direct Object Reference PoC, Patch Analysis & Rule
March 18, 2026
CVE-2025-68514 affects the Paid Member Subscriptions plugin (up to 2.16.8) with a medium severity (CVSS 4.3) vulnerability. Update to version…
CVE-2026-24959: JS Help Desk <= 3.0.1 Authenticated (Subscriber+) SQL Injection PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-24959 affects the JS Support Ticket plugin (up to 3.0.1) with a medium severity SQL injection vulnerability (CVSS 6.5). Update…
CVE-2026-0724: WPlyr Media Block <= 1.3.0 Authenticated (Administrator+) Stored Cross-Site Scripting via '_wplyr_accent_color' Parameter PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-0724 affects the WPlyr Media Block plugin (up to v1.3.0) with a CVSS score of 4.4. Authenticated attackers can exploit…
CVE-2026-1215: MMA Call Tracking <= 2.3.15 Cross-Site Request Forgery to Plugin Settings Update PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1215 affects the MMA Call Tracking plugin for WordPress (up to version 2.3.15) with a medium severity CVSS score of…
CVE-2026-1827: IDE Micro code-editor <= 1.0.0 Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1827 affects the Flask Micro plugin for WordPress (up to version 1.0.0) with a CVSS score of 6.4. Authenticated users…
CVE-2026-1804: WDES Responsive Popup <= 1.3.6 Authenticated (Contributor+) Stored Cross-Site Scripting via 'attr' Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1804 affects the Wdes Responsive Popup plugin (up to v1.3.6) with a medium severity (CVSS 6.4) stored XSS vulnerability. Authenticated…
CVE-2026-1748: Invoct – PDF Invoices & Billing for WooCommerce <= 1.6 Missing Authorization to Authenticated (Subscriber+) Information Exposure PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1748 affects the Kirilkirkov Pdf Invoice Manager plugin (up to v1.6) with a CVSS score of 4.3. Authenticated users can…
CVE-2026-1853: BuddyHolis ListSearch <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'placeholder' Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1853 affects the Listsearch plugin for WordPress (up to v1.1) with a CVSS score of 6.4. This medium-severity XSS vulnerability…
CVE-2026-28126: RH Frontend Publishing Pro <= 4.3.2 Reflected Cross-Site Scripting PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-28126 affects the RH Frontend Publishing Pro plugin (up to version 4.3.2) with a medium severity CVSS score of 6.1.…
CVE-2026-1826: OpenPOS Lite <= 3.0 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1826 affects OpenPOS Lite Version 3.0, allowing authenticated attackers to exploit a stored XSS vulnerability with a CVSS score of…
CVE-2026-1809: HTML Shortcodes <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1809 affects the Html Shortcodes plugin for WordPress, with a CVSS score of 6.4. Users should update to the patched…
CVE-2026-1885: Slideshow Wp <= 1.1 Authenticated (Contributor+) Stored Cross-Site Scripting via 'sswp-slide' Shortcode 'sswpid' Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1885 affects the Slideshow Wp plugin (up to version 1.1) with a medium severity CVSS score of 6.4. Authenticated attackers…
CVE-2026-1893: Orbisius Random Name Generator <= 1.0.2 Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_label' Shortcode Attribute PoC, Patch Analysis & Rule
March 18, 2026
CVE-2026-1893 affects the Orbisius Random Name Generator plugin (up to 1.0.2) with a medium severity CVSS score of 6.4. Authenticated…
←
1
…
113
114
115
116
117
…
120
→