Medium
CVE-2025-13722
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-13974
Email Customizer for WooCommerce | Drag and Drop Email Templates Builder <= 2.6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via Email Template Content
Medium
CVE-2025-14626
QR Code for WooCommerce order emails, PDF invoices, packing slips <= 1.9.42 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode Attributes
High
CVE-2025-14070
Reviewify <= 1.0.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary WooCommerce Coupon Creation
High
CVE-2025-13801
Yoco Payments <= 3.9.0 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-13887
AI BotKit <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-14460
Piraeus Bank WooCommerce Payment Gateway <= 3.1.4 - Missing Authorization to Unauthenticated Arbitrary Order Status Change
Medium
CVE-2025-12540
ShareThis Dashboard for Google Analytics <= 3.2.4 - Unauthenticated Google Analytics Data Exposure
Critical
CVE-2025-15018
Optional Email <= 1.3.11 - Unauthenticated Privilege Escalation to Account Takeover
High
CVE-2025-13493
Latest Registered Users <= 1.4 - Missing Authorization to Unauthenticated Sensitive Information Exposure via User Data Export
High
CVE-2025-11877
User Activity Log <= 2.2 - Unauthenticated Limited Options Update via Failed Login
Medium
CVE-2025-12449
aBlocks – WordPress Gutenberg Blocks <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Settings Modification
High
CVE-2025-13371
Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14904
Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14867
Flashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal
Medium
CVE-2025-14887
twinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings
High
CVE-2026-0656
iPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure
Medium
CVE-2025-14842
Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload
Medium
CVE-2025-14901
Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay
Medium
CVE-2025-14891
Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
Medium
CVE-2025-14059
EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal
High
CVE-2026-24635
EduBlink Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-67934
Wellspring < 2.8 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27327
YayMail – WooCommerce Email Customizer <= 4.3.2 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.