Medium
CVE-2025-13656
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-13856
Extra Post Images <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13308
Application Passwords <= 0.1.3 - Reflected Cross-Site Scripting via reject_url
Medium
CVE-2025-12720
g-FFL Cockpit <= 1.7.1 - Improper Authorization to Unauthenticated Product Deletion
Medium
CVE-2025-12721
g-FFL Cockpit <= 1.7.1 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-13629
WP Landing Page <= 0.9.3 - Cross-Site Request Forgery to Arbitrary Post Meta Update
Medium
CVE-2025-13907
CSS3 Buttons <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13894
CSV Sumotto <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-12577
Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update
Medium
CVE-2025-12574
Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Medium
CVE-2025-12717
List Attachments Shortcode <= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode
Medium
CVE-2025-13666
Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification
Medium
CVE-2025-12091
Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Medium
CVE-2025-13626
myLCO <= 0.8.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-13898
Ultra Skype Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute
Medium
CVE-2025-13899
TR Timthumb <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Critical
CVE-2025-12673
Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-13857
Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13922
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause
Medium
CVE-2025-12505
weDocs <= 2.1.14 - Missing Authorization to Settings Update
High
CVE-2025-12510
Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews
Medium
CVE-2025-11263
Link Whisper Free <= 0.8.8 - Reflected Cross-Site Scripting
Critical
CVE-2024-54229
SV100 Companion <= 2.0.02 - Unauthenticated Privilege Escalation
Medium
CVE-2025-67948
SendPulse Email Marketing Newsletter <= 2.2.1 - Authenticated (Subscriber+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.