Medium
CVE-2025-12074
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-12071
Frontend User Notes <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Note Modification
Medium
CVE-2025-12075
Order Splitter for WooCommerce <= 5.3.5 - Missing Authorization to Authenticated (Subscriber+) Order Information Exposure
Medium
CVE-2025-12037
WP 404 Auto Redirect <= 1.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2026-1925
EmailKit – Email Customizer for WooCommerce & WP <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Title Modification
Medium
CVE-2025-13959
Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2026-1277
URL Shortify <= 1.12.1 - Unauthenticated Open Redirect via 'redirect_to' Parameter
Medium
CVE-2026-1296
Frontend Post Submission Manager Lite <= 1.2.7 - Unauthenticated Open Redirect via 'requested_page' Parameter
High
CVE-2026-1714
ShopLentor <= 3.3.2 - Unauthenticated Email Relay Abuse via 'woolentor_suggest_price_action' AJAX Action
High
CVE-2026-2576
Business Directory Plugin <= 6.4.21 - Unauthenticated SQL Injection via payment Parameter
Medium
CVE-2025-6460
Display During Conditional Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via message Parameter
High
CVE-2026-1931
Rent Fetch <= 0.32.4 - Unauthenticated Stored Cross-Site Scripting via 'keyword' Parameter
High
CVE-2026-22370
Marveland <= 1.3.0 - Unauthenticated Local File Inclusion
Medium
CVE-2026-1317
WP Import – Ultimate CSV XML Importer for WordPress <= 7.37 - Authenticated (Subscriber+) SQL Injection via File Name
High
CVE-2026-22368
Redy <= 1.0.2 - Unauthenticated Local File Inclusion
High
CVE-2026-22372
Isida <= 1.4.2 - Unauthenticated Local File Inclusion
Medium
CVE-2025-14799
Brevo - Email, SMS, Web Push, Chat, and more. <= 3.3.0 - Unauthenticated Authorization Bypass via Type Juggling
Medium
CVE-2026-1508
Court Reservation – Manage Your Court Bookings Online < 1.10.9 - Cross-Site Request Forgery
High
CVE-2026-22366
Jude <= 1.3.0 - Unauthenticated Local File Inclusion
High
CVE-2026-22380
UnlimHost <= 1.2.3 - Unauthenticated Local File Inclusion
High
CVE-2026-22362
Photolia <= 1.0.3 - Unauthenticated Local File Inclusion
High
CVE-2026-22371
Gustavo <= 1.2.2 - Unauthenticated Local File Inclusion
Medium
CVE-2026-1404
Ultimate Member <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters
Medium
CVE-2026-25370
Compress <= 6.60.28 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.