High
CVE-2025-12139
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-12384
Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
Medium
CVE-2025-11917
WPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feed
Critical
CVE-2025-11749
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
High
CVE-2025-12197
The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s
Medium
CVE-2025-11162
Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS
Medium
CVE-2025-11835
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal
Medium
CVE-2025-12580
SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-12582
Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset
Medium
CVE-2025-8871
Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
Medium
CVE-2025-64228
SUMO Affiliates Pro <= 11.0.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-64275
Booking Manager <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49913
CoSchedule <= 3.4.0 - Missing Authorization
Critical
CVE-2025-12674
KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-62106
WP-CRM System <= 3.4.5 - Missing Authorization
Medium
CVE-2025-49903
ZoloBlocks <= 2.3.11 - Missing Authorization
Medium
CVE-2025-64365
Ohio Extra <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12677
KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure
Medium
CVE-2025-64220
Rey Core <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12400
LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-11733
Footnotes Made Easy <= 3.0.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11812
Reuse Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12452
Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-11758
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.