High
CVE-2025-68546
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2025-68544
Diza <= 1.3.15 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-67467
GiveWP <= 4.13.1 - Cross-Site Request Forgery
Medium
CVE-2025-68551
VPSUForm <= 3.2.24 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-14163
Premium Addons for Elementor <= 4.11.53 - Cross-Site Request Forgery via 'insert_inner_template'
Medium
CVE-2025-14155
Premium Addons for Elementor <= 4.11.53 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'get_template_content'
Medium
CVE-2025-68989
Contact Form 7 Extension For Mailchimp <= 0.9.54 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-67628
Review Disclaimer <= 2.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2025-14855
SureForms <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-14071
Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode
Medium
CVE-2025-14043
Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation
Medium
CVE-2025-7733
WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference
High
CVE-2025-68987
Cinerama - A WordPress Theme for Movie Studios and Filmmakers <= 2.4 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-68985
Aora <= 1.3.15 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-68983
Greenmart <= 4.2.11 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-68984
Puca <= 2.6.39 - Authenticated (Contributor+) Local File Inclusion
Critical
CVE-2025-13619
Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation
Medium
CVE-2025-12361
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-68568
Claspo – Popups, Spin the Wheel & Email Capture <= 1.0.7 - Missing Authorization
Medium
CVE-2025-12496
Zephyr Project Manager <= 3.3.203 - Authenticated (Custom+) Arbitrary File Read And Server-Side Request Forgery
High
CVE-2025-11924
Ninja Forms – The Contact Form Builder That Grows With You <= 3.13.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Unscoped Bearer Token
Medium
CVE-2025-14154
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-13741
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) Authors' Emails Exposure
Medium
CVE-2025-11991
JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.