Medium
CVE-2025-64367
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-11377
List category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure
High
CVE-2025-10487
Advanced Ads <= 2.0.12 - Unauthenticated Limited Code Execution
Medium
CVE-2025-64264
Popup addon for Ninja Forms <= 3.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-64632
Google XML Sitemaps <= 4.1.22 - Missing Authorization
Critical
CVE-2025-11499
Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-12041
ERI File Library <= 1.1.0 - Missing Authorization to Unauthenticated Protected File Download
Medium
CVE-2025-8383
Depicter <= 4.0.4 - Cross-Site Request Forgery
High
CVE-2025-10897
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
Critical
CVE-2025-5397
Jobmonster - Job Board WordPress Theme <= 4.8.1 - Authentication Bypass
High
CVE-2025-7846
WordPress User Extra Fields <= 16.7 - Authenticated (Subscriber+) Arbitrary File Deletion via save_fields Function
Medium
CVE-2025-11806
Qzzr Shortcode Plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11975
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
Medium
CVE-2025-64265
Frontend File Manager <= 23.2 - Missing Authorization
High
CVE-2025-12115
WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration
Medium
CVE-2025-8385
Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read
Medium
CVE-2025-64357
Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery
Medium
CVE-2025-12094
OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing
Medium
CVE-2025-12175
The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
Medium
CVE-2025-64379
Booster for WooCommerce <= 7.4.0 - Missing Authorization
Medium
CVE-2025-10636
NS Maintenance Mode for WP <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Critical
CVE-2025-8489
King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation
Medium
CVE-2025-64358
Smart Coupons for WooCommerce <= 2.2.3 - Missing Authorization
Medium
CVE-2025-67599
WebToffee eCommerce Marketing Automation <= 2.1.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.