High
CVE-2025-68062
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-68500
Prime Slider – Addons For Elementor <= 4.0.10 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2025-67523
Exhibz <= 3.0.9 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-24945
Ultimate Addons for Contact Form 7 <= 3.5.34 - Missing Authorization
Medium
CVE-2025-0969
Brizy – Page Builder <= 2.7.16 - Authenticated (Contributor+) Sensitive Information Exposure via get_users Function
Medium
CVE-2025-8199
MarqueeAddons <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widget
Medium
CVE-2025-8687
Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets
Medium
CVE-2025-9856
Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9207
TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection
Medium
CVE-2025-8779
All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets
Critical
CVE-2025-10738
URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection
Medium
CVE-2025-12362
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval
High
CVE-2025-13094
WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-14508
MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion
Medium
CVE-2025-13705
Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter
Medium
CVE-2025-14539
Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter
Medium
CVE-2025-14378
Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-13077
افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection
Medium
CVE-2025-14394
Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update
Medium
CVE-2025-14395
Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions
Medium
CVE-2025-14462
Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14451
Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter
High
CVE-2025-14476
Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import
Medium
CVE-2025-14540
Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.