Medium-severity CVEs (page 25)

Page 25 of 100 — medium-severity CVEs, newest first, with CVSS scores and publication dates.

All medium-severity CVEs — newest first (page 25 of 100)
CVESeverityScorePublishedSummary
CVE-2026-48532Medium5.42026-07-23GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated att…
CVE-2026-48531Medium5.42026-07-23GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inj…
CVE-2026-48530Medium5.42026-07-23GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to…
CVE-2026-11804Medium5.22026-07-23Improper handling of insufficient permissions or privileges vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Secur…
CVE-2026-8287Medium4.32026-07-23Allocation of resources without limits or throttling vulnerability in BizimHesap Information Systems Industry and Trade Inc. Online Pre-Accounting Software all…
CVE-2026-65914Medium6.12026-07-23DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like…
CVE-2026-65913Medium6.12026-07-23DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array…
CVE-2026-65912Medium6.12026-07-23DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeChe…
CVE-2026-65911Medium6.12026-07-23In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) ac…
CVE-2026-65904Medium4.72026-07-23DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's co…
CVE-2026-65903Medium6.12026-07-23DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions…
CVE-2026-65902Medium6.12026-07-23DOMPurify before 3.4.7 (affected versions <= 3.4.5) passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the upon…
CVE-2026-65901Medium6.12026-07-23DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attacke…
CVE-2026-65900Medium6.12026-07-23DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PL…
CVE-2026-65899Medium6.12026-07-23DOMPurify 3.0.0 before 3.4.9 does not reset the retained Trusted Types policy when clearConfig() is called, so a DOMPurify instance reused across trust boundar…
CVE-2026-16735Medium5.32026-07-23A security vulnerability has been detected in release-it conventional-changelog up to 11.0.1. This affects the function writeChangelog of the file index.js of…
CVE-2026-16733Medium5.32026-07-23A weakness has been identified in bahmutov find-cypress-specs up to 1.54.12. The impacted element is the function shell.exec of the file src/index.js of the co…
CVE-2026-65607Medium6.52026-07-23SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler (kernel/server/serve.go). Unl…
CVE-2026-65550Medium5.92026-07-23Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
CVE-2026-65538Medium5.92026-07-23Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
CVE-2026-65537Medium4.32026-07-23Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
CVE-2026-65536Medium6.52026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in افزونه حمل و نقل ووکامرس (پست پیشتاز و سفارشی، پیک موتوری) <= 4.4.5 versions.
CVE-2026-65535Medium4.32026-07-23Contributor Sensitive Data Exposure in TinyMCE Templates <= 4.8.1 versions.
CVE-2026-65534Medium5.92026-07-23Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
CVE-2026-65533Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
CVE-2026-65531Medium4.82026-07-23Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
CVE-2026-65530Medium4.32026-07-23Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
CVE-2026-65529Medium5.32026-07-23Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.
CVE-2026-65528Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
CVE-2026-65527Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
CVE-2026-65525Medium5.32026-07-23Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
CVE-2026-65524Medium4.32026-07-23Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
CVE-2026-65522Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
CVE-2026-65521Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
CVE-2026-65519Medium6.52026-07-23Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
CVE-2026-65518Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
CVE-2026-65514Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
CVE-2026-65512Medium5.42026-07-23Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This iss…
CVE-2026-65506Medium5.32026-07-23Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
CVE-2026-65505Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
CVE-2026-65503Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
CVE-2026-65501Medium5.32026-07-23Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
CVE-2026-65499Medium6.52026-07-23Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
CVE-2026-65498Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
CVE-2026-65496Medium4.42026-07-23Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
CVE-2026-65491Medium4.32026-07-23Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.
CVE-2026-65490Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.
CVE-2026-65489Medium5.32026-07-23Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65487Medium5.32026-07-23Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
CVE-2026-65486Medium5.32026-07-23Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
CVE-2026-65485Medium5.32026-07-23Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
CVE-2026-65484Medium6.32026-07-23Contributor Broken Access Control in Style Kits <= 2.6.5 versions.
CVE-2026-65483Medium5.92026-07-23Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
CVE-2026-65482Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
CVE-2026-65480Medium6.52026-07-23Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affe…
CVE-2026-65479Medium5.42026-07-23Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
CVE-2026-65478Medium5.42026-07-23Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
CVE-2026-65476Medium5.32026-07-23Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
CVE-2026-65475Medium6.52026-07-23Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This is…
CVE-2026-65474Medium5.32026-07-23Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
CVE-2026-65473Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
CVE-2026-65472Medium5.32026-07-23Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
CVE-2026-65470Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
CVE-2026-65469Medium5.32026-07-23Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
CVE-2026-65468Medium5.32026-07-23Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
CVE-2026-65467Medium4.92026-07-23Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.
CVE-2026-65466Medium4.92026-07-23Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
CVE-2026-65465Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
CVE-2026-65464Medium5.42026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
CVE-2026-65463Medium5.42026-07-23Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
CVE-2026-65460Medium4.32026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
CVE-2026-65458Medium4.32026-07-23Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby Polylang Pro allows Retrieve Embedded Se…
CVE-2026-65457Medium4.32026-07-23Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
CVE-2026-65456Medium4.32026-07-23Contributor Insecure Direct Object References (IDOR) in Product Slider for WooCommerce <= 1.13.62 versions.
CVE-2026-65453Medium5.32026-07-23Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
CVE-2026-65452Medium5.32026-07-23Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.
CVE-2026-65449Medium6.52026-07-23Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions.
CVE-2026-64810Medium4.32026-07-23In JetBrains IntelliJ IDEA before 2026.2 hTML injection was possible in an IDE notification, allowing silent user activity tracking
CVE-2026-61981Medium5.42026-07-23Unauthenticated Cross Site Request Forgery (CSRF) in Simple Link Directory Pro <= 15.0.8 versions.
CVE-2026-61973Medium4.32026-07-23Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
CVE-2026-61972Medium5.32026-07-23Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.
CVE-2026-61946Medium6.52026-07-23Unauthenticated Insecure Direct Object References (IDOR) in Easy Appointments <= 3.12.27 versions.
CVE-2026-61945Medium6.52026-07-23Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in MultiVendorX WooCommerce Product Stock Alert allows Retrieve Embedd…
CVE-2026-59524Medium6.52026-07-23Unauthenticated Broken Authentication in Easy Digital Downloads <= 3.6.7 versions.
CVE-2026-59522Medium6.52026-07-23Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.
CVE-2026-59513Medium6.52026-07-23Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions.
CVE-2026-57808Medium6.52026-07-23Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.
CVE-2026-57717Medium6.52026-07-23Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.
CVE-2026-57716Medium5.32026-07-23Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions.
CVE-2026-57703Medium6.32026-07-23Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.
CVE-2026-57425Medium6.52026-07-23Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.
CVE-2026-57384Medium6.52026-07-23Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions.
CVE-2026-57373Medium6.52026-07-23Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions.
CVE-2026-27423Medium4.32026-07-23Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.
CVE-2026-27422Medium5.32026-07-23Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions.
CVE-2026-27418Medium5.32026-07-23Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.
CVE-2026-27403Medium6.52026-07-23Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affe…
CVE-2026-27399Medium5.32026-07-23Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.
CVE-2026-27392Medium4.32026-07-23Contributor Broken Access Control in uListing <= 2.2.0 versions.
CVE-2026-27391Medium5.42026-07-23Subscriber Broken Access Control in uListing <= 2.2.0 versions.