High
CVE-2025-49919
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-66106
Featured Post Creative <= 1.5.5 - Missing Authorization
Critical
CVE-2025-13597
AI Feeds <= 1.0.11 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-13595
CIBELES AI <= 1.10.8 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-67471
Quick Contact Form <= 8.2.5 - Cross-Site Request Forgery
Medium
CVE-2025-66078
Hotel Booking Lite <= 5.2.3 - Authenticated (Hotel Worker+) Remote Code Execution
Medium
CVE-2025-67588
Elementor Website Builder <= 3.33.0 - Missing Authorization
Medium
CVE-2025-66072
UsersWP <= 1.2.47 - Missing Authorization
Medium
CVE-2025-67597
Fluent Booking <= 1.9.11 - Missing Authorization
Medium
CVE-2025-13389
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated Information Disclosure
Medium
CVE-2025-13452
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 14 - Missing Authorization to Unauthenticated User Impersonation in Order Messages
Medium
CVE-2025-13414
Chamber Dashboard Business Directory <= 3.3.11 - Missing Authorization to Unauthenticated Business Information Export
Medium
CVE-2025-12634
Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update
Medium
CVE-2025-12525
Locker Content <= 1.0.0 - Unauthenticated Information Exposure
Medium
CVE-2025-12040
Wishlist for WooCommerce <= 1.1.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Medium
CVE-2025-13382
Frontend File Manager Plugin <= 23.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary File Renaming
Medium
CVE-2025-12043
Autochat Automatic Conversation <= 1.1.9 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-12586
Conditional Maintenance Mode for WordPress <= 1.0.0 - Cross-Site Request Forgery
Medium
CVE-2025-12025
YouTube Subscribe <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Title and Channel ID
Medium
CVE-2025-13311
Just Highlight <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Highlight Color' Setting
Medium
CVE-2025-13386
Social Images Widget <= 2.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
Medium
CVE-2025-13370
ProjectList <= 0.3.0 - Authenticated (Editor+) SQL Injection via 'id' Parameter
High
CVE-2025-13376
ProjectList <= 0.3.0 - Authenticated (Editor+) Arbitrary File Upload
Medium
CVE-2025-12645
Inline frame – Iframe <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.