Medium
CVE-2025-12526
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-11521
Astra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-11869
Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12663
Jeba Cute forkit <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-11457
EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-12668
WP Count Down Timer <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11986
Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State
Medium
CVE-2025-11988
Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion
Medium
CVE-2025-12589
WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-12711
Share to Google Classroom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google Shortcode
High
CVE-2025-11168
Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-11828
Magazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11863
My Geo Posts Free <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12020
Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-12665
Ninja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion
Medium
CVE-2025-12631
Squirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-11821
Woocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-12813
Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'
Medium
CVE-2025-12658
Preload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11882
Simple Donate <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12538
Fleet Manager <= 2.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-12590
YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-11532
Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Medium
CVE-2025-11822
WP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.