Medium
CVE-2025-68494
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-62762
SMTP Mail <= 1.3.49 - Cross-Site Request Forgery
Medium
CVE-2025-63008
ERP <= 1.16.7 - Missing Authorization
Medium
CVE-2025-62737
Image Cleanup <= 1.9.2 - Unauthenticated Information Exposure
Medium
CVE-2025-49348
Hype <= 1.0.5 - Missing Authorization
Medium
CVE-2025-62994
AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-63025
Xagio SEO <= 7.1.0.37 - Missing Authorization
Medium
CVE-2025-62734
Media Library Downloader <= 1.4.0 - Cross-Site Request Forgery
Medium
CVE-2025-63015
WooCommerce Payment Gateway – Paysera <= 3.10.0 - Missing Authorization
Medium
CVE-2025-66083
WpEvently <= 5.0.4 - Missing Authorization
Medium
CVE-2025-12826
Custom Post Type UI <= 1.18.0 - Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modification
Medium
CVE-2025-12782
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering
Medium
CVE-2025-13513
Clik stats <= 0.8 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
High
CVE-2025-11727
Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11379
WebP Express <= 0.25.9 - Unauthenticated Information Exposure
Medium
CVE-2025-13756
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management
Critical
CVE-2025-13390
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
Medium
CVE-2025-13401
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13354
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation
Medium
CVE-2025-13359
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2025-13342
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
Medium
CVE-2025-13109
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
Medium
CVE-2025-12887
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
Medium
CVE-2025-67596
Business Directory <= 6.4.19 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.