Medium
CVE-2025-14164
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-14721
Responsive and Swipe slider <= 1.0.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12898
Pretty Google Calendar <= 2.0.0 - Missing Authorization to Unauthenticated Google API Key Exposure
Medium
CVE-2025-13365
WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-12581
Attachments Handler <= 1.1.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-14168
WP DB Booster <= 1.0.1 - Cross-Site Request Forgery to Database Cleanup
Medium
CVE-2025-14734
Amazon affiliate lite Plugin <= 1.0.0 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14735
Amazon affiliate lite Plugin <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Critical
CVE-2025-13329
File Uploader for WooCommerce <= 1.0.3 - Unauthenticated Arbitrary File Upload via add-image-data
Medium
CVE-2025-14633
F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download
Medium
CVE-2025-68565
Twitch Player <= 2.1.3 - Missing Authorization
Medium
CVE-2025-68596
Bit Assist <= 1.5.11 - Missing Authorization
Medium
CVE-2025-14803
Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-14455
Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management
Medium
CVE-2025-12361
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure
High
CVE-2025-14151
SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11747
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-14449
BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcode
High
CVE-2025-13999
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-13754
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-68592
Adminify <= 4.0.6.1 - Missing Authorization
Medium
CVE-2025-68979
Google Calendar Events <= 3.5.9 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-23548
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.25 - Missing Authorization
Medium
CVE-2025-68982
DesignThemes LMS Addon <= 2.6 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.