Medium
CVE-2025-14387
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-14383
Booking Calendar <= 10.14.8 - Unauthenticated SQL Injection via dates_to_check
Critical
CVE-2025-14156
Fox LMS – WordPress LMS Plugin 1.0.4.7 - 1.0.5.1 - Unauthenticated Privilege Escalation via 'createOrder'
Medium
CVE-2025-14003
Image Gallery – Photo Grid & Video Gallery <= 2.13.3 - Missing Authorization to Authenticated (Author+) Arbitrary Gallery Modification
Medium
CVE-2025-13728
FluentAuth - Auth Security Plugin <= 2.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluent_auth_reset_password' Shortcode
Medium
CVE-2025-13610
RegistrationMagic <= 6.0.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'RM_Forms' Shortcode
Medium
CVE-2025-13608
CC Child Pages <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'child_pages' Shortcode
Medium
CVE-2025-13950
OneSignal – Web Push Notifications <= 3.6.1 - Missing Authorization to Unauthenticated Plugin Settings Update
Medium
CVE-2025-13367
User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-12900
FileBird – WordPress Media Library Folders & File Manager <= 6.5.1 - Missing Authorization to Authenticated (Author+) Global Folders Tampering
Medium
CVE-2025-64256
Simple Folio <= 1.1.0 - Cross-Site Request Forgery
Medium
CVE-2025-67999
Newsletter <= 9.0.9 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-67557
eBay Product Feeds <= 3.4.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-24947
LA-Studio Element Kit for Elementor < 1.5.6.3 - Missing Authorization
Medium
CVE-2025-67574
Booking calendar, Appointment Booking System <= 3.2.30 - Missing Authorization
Medium
CVE-2025-67562
Image Caption Hover Pro < 20.0 - Missing Authorization
Medium
CVE-2025-67541
WP-ShowHide <= 1.05 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-67976
Watu Quiz <= 3.4.5 - Missing Authorization
Medium
CVE-2025-68083
Meks Quick Plugin Disabler <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-67582
Wbcom Designs <= 2.1.1 - Missing Authorization
Medium
CVE-2025-67560
Listdom <= 5.0.1 - Missing Authorization
Medium
CVE-2025-13231
Fancy Product Designer | WooCommerce WordPress <= 6.4.8 - Unauthenticated Server-Side Request Forgery via Race Condition
Medium
CVE-2025-64250
Directorist <= 8.6.6 - Unauthenticated Open Redirect
High
CVE-2025-67525
ekommart < 4.3.1 - Authenticated (Contributor+) Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.