Medium
CVE-2025-11268
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-12360
Better Find and Replace <= 1.7.7 - Missing Authorization
Medium
CVE-2025-12471
Hubbub Lite <= 1.36.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-12560
Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url
Medium
CVE-2025-12563
Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload
Medium
CVE-2025-11271
Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation
Medium
CVE-2025-10691
Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion
Medium
CVE-2025-10683
Easy Email Subscription <= 1.3 - Authenticated (Admin+) SQL Injection via uid
Medium
CVE-2025-63011
Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-63013
Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure
Medium
CVE-2025-63012
Hotel Booking <= 2.2.8 - Cross-Site Request Forgery
Critical
CVE-2025-12061
Tax Service Electronic HDM <= 1.2.0 - Unauthenticated Arbitrary SQL Injection
Medium
CVE-2025-62107
Feather Login Page <= 1.1.7 - Cross-Site Request Forgery
High
CVE-2025-12497
Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]
Medium
CVE-2025-11745
Ad Inserter <= 2.8.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field
Medium
CVE-2025-11987
Visual Link Preview <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode
Medium
CVE-2025-12468
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-11820
Graphina – Elementor Charts and Graphs <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Chart Widgets
Medium
CVE-2025-12192
The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12469
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
Medium
CVE-2025-12675
KiotViet Sync <= 1.8.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2025-12676
KiotViet Sync <= 1.8.5 - Use of Hard-coded Password to Authorization Bypass
Medium
CVE-2025-11373
Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Safe File Type Upload
Medium
CVE-2025-12388
B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.