Security Risk Severity
Medium Security Risks
Published vulnerability pages grouped by medium severity. Use this page to review risks that need similar prioritization.
969 published medium risks
Medium severity
Showing 1–36 of 969 published risks.
CVE-2026-65470 Fluent Support vulnerability
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
Updated Jul 24, 2026
CVE-2026-65472 Kit (formerly ConvertKit) vulnerability
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
Updated Jul 24, 2026
CVE-2026-65473 Virtue/Ascend/Pinnacle Toolkit vulnerability
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
Updated Jul 24, 2026
CVE-2026-65475 Modula Image Gallery vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Updated Jul 24, 2026
CVE-2026-65474 Ninja Tables vulnerability
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
Updated Jul 24, 2026
CVE-2026-65476 Civi vulnerability
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
Updated Jul 24, 2026
CVE-2026-65478 ListingPro vulnerability
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
Updated Jul 24, 2026
CVE-2026-65479 Reviewer vulnerability
Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
Updated Jul 24, 2026
CVE-2026-65480 TheGem vulnerability
Contributor Cross Site Scripting (XSS) in TheGem <= 5.11.1 versions.
Updated Jul 24, 2026
CVE-2026-65482 LA-Studio Element Kit for Elementor vulnerability
Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
Updated Jul 24, 2026
CVE-2026-65483 HashThemes Demo Importer vulnerability
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
Updated Jul 24, 2026
CVE-2026-65484 Style Kits vulnerability
Contributor Broken Access Control in Style Kits <= 2.6.5 versions.
Updated Jul 24, 2026
CVE-2026-65485 Content Control vulnerability
Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
Updated Jul 24, 2026
CVE-2026-65487 Photography vulnerability
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
Updated Jul 24, 2026
CVE-2026-65486 Event post vulnerability
Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
Updated Jul 24, 2026
CVE-2026-65489 LA-Studio Element Kit for Elementor vulnerability
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
Updated Jul 24, 2026
CVE-2026-65490 Create by Mediavine vulnerability
Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.
Updated Jul 24, 2026
CVE-2026-65491 Query Wrangler vulnerability
Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.
Updated Jul 24, 2026
CVE-2026-65496 Complianz vulnerability
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
Updated Jul 24, 2026
CVE-2026-65498 Complianz vulnerability
Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
Updated Jul 24, 2026
CVE-2026-65501 Shiptastic for WooCommerce vulnerability
Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
Updated Jul 24, 2026
CVE-2026-65499 PeproDev Ultimate Invoice vulnerability
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
Updated Jul 24, 2026
CVE-2026-65505 Ultimate Store Kit Elementor Addons vulnerability
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
Updated Jul 24, 2026
CVE-2026-65503 Ultimate Store Kit Elementor Addons vulnerability
Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
Updated Jul 24, 2026
CVE-2026-65506 MP3 Audio Player for Music, Radio & Podcast by Sonaar vulnerability
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
Updated Jul 24, 2026
CVE-2026-65514 Appointment Hour Booking vulnerability
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
Updated Jul 24, 2026
CVE-2026-65512 WP Activity Log vulnerability
Unauthenticated Cross Site Request Forgery (CSRF) in WP Activity Log <= 5.6.4 versions.
Updated Jul 24, 2026
CVE-2026-65521 WP Social Ninja vulnerability
Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
Updated Jul 24, 2026
CVE-2026-65518 Accept Donations with PayPal & Stripe vulnerability
Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
Updated Jul 24, 2026
CVE-2026-65519 Photo Gallery vulnerability
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
Updated Jul 24, 2026
CVE-2026-65522 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Updated Jul 24, 2026
CVE-2026-65525 Civi Framework vulnerability
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
Updated Jul 24, 2026
CVE-2026-65524 Avada Custom Branding vulnerability
Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
Updated Jul 24, 2026
CVE-2026-65527 LIQUID SPEECH BALLOON vulnerability
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
Updated Jul 24, 2026
CVE-2026-65530 TemplateSpare vulnerability
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
Updated Jul 24, 2026
CVE-2026-65529 Graphina vulnerability
Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.
Updated Jul 24, 2026