Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions.
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 ve
Unauthenticated Sensitive Data Exposure in WP Social Ninja <= 4.3.0 versions.
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
Cross-Site request forgery (CSRF) vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allow
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
Unauthenticated Sensitive Data Exposure in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
Unauthenticated Sensitive Data Exposure in Complianz <= 7.5.0 versions.
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.
Unauthenticated Sensitive Data Exposure in Create by Mediavine <= 2.5.3 versions.
Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.
Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.
Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.
Contributor Broken Access Control in Style Kits <= 2.6.5 versions.
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem
Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.
Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.
Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Im
Unauthenticated Sensitive Data Exposure in Ninja Tables <= 5.2.10 versions.
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.
Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.
Contributor Server Side Request Forgery (SSRF) in JetEngine <= 3.8.11 versions.
Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in GiveWP <= 4.16.3 versions.
Subscriber Insecure Direct Object References (IDOR) in Masteriyo - LMS <= 2.3.1 versions.
Unauthenticated Cross Site Request Forgery (CSRF) in Zarinpal Gateway <= 5.1.0 versions.
Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Chouby Polylang and Chouby P
Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.
Frequently Asked Questions
What does MEDIUM severity mean for CVEs?
CVSS 4.0–6.9 — moderate vulnerabilities that may require specific conditions or user interaction to exploit
How many medium severity CVEs exist?
There are 164,190 CVE records rated MEDIUM in our database. Of these, 101 are listed in CISA's Known Exploited Vulnerabilities catalog.
How should I prioritize medium severity vulnerabilities?
MEDIUM severity vulnerabilities should be addressed as part of regular patching cycles. Prioritize those with high EPSS scores or that affect critical systems. CyberStrike helps you assess real-world exploitability beyond CVSS scores.
Detect MEDIUM Vulnerabilities
CyberStrike scans your infrastructure and detects medium severity vulnerabilities in real time.
Get Started