Medium
CVE-2025-66529
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-63024
Order Delivery Date for WooCommerce <= 4.3.1 - Missing Authorization
Critical
CVE-2025-13407
Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-62090
Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons <= 3.0.2 - Missing Authorization
Medium
CVE-2025-63043
Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-12358
ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
Critical
CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Medium
CVE-2025-10304
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure
Medium
CVE-2025-13495
FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter
Medium
CVE-2025-12585
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
Medium
CVE-2025-13448
CSSIgniter Shortcodes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
High
CVE-2025-13646
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
High
CVE-2025-13645
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion
Critical
CVE-2025-13542
DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2025-66110
Tiktok Feed <= 1.0.23 - Missing Authorization
Medium
CVE-2025-67595
Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery
Medium
CVE-2025-59133
Projectopia <= 5.1.22 - Authenticated (Custom+) Insecure Direct Object Reference
Medium
CVE-2025-64238
WPS Bidouille <= 1.33.1 - Missing Authorization
Medium
CVE-2025-13090
WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection
High
CVE-2025-13516
SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload
High
CVE-2025-13724
VikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter
Medium
CVE-2025-11726
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification
Medium
CVE-2025-13696
Zigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint
Medium
CVE-2025-13685
Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.