Medium
CVE-2025-12096
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-11504
Quickcreator – AI Blog Writer 0.0.9 - 0.1.17 - Unauthenticated API Key Exposure
Medium
CVE-2025-10901
Originality.ai AI Checker <= 1.0.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'ai_get_table'
Medium
CVE-2025-10902
Originality.ai AI Checker <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Scan Log Deletion via ' ai_scan_result_remove'
Medium
CVE-2025-7730
Bold Page Builder <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `percentage` Parameter
Medium
CVE-2025-62986
FanBridge signup <= 0.6 - Cross-Site Request Forgery
Medium
CVE-2025-12134
ZoloBlocks <= 2.3.11 - Missing Authorization to Unauthenticated Popup Enable/Disable
Medium
CVE-2025-64366
MasterStudy LMS <= 3.6.27 - Authenticated (Instructor+) SQL Injection
Critical
CVE-2025-6440
WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Upload
High
CVE-2025-64188
Soledad < = 8.6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2025-12136
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint
Medium
CVE-2025-11257
LLM Hubspot Blog Import <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Hubspot Import
High
CVE-2025-10861
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-11576
AI Chatbot Free Models – Customer Support, Live Chat, Virtual Assistant <= 1.6.5 - Unauthenticated CSV Injection
Medium
CVE-2025-66118
Sprout Clients <= 3.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-62985
Simple Pull Quote <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62987
Builderall Builder for WordPress <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10705
MxChat – AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery
Medium
CVE-2025-11128
Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-59009
Listify <= 3.2.5 - Cross-Site Request Forgery
Medium
CVE-2025-8427
Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'
Medium
CVE-2025-62983
Posts By Tag <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10638
NS Maintenance Mode for WP <= 1.3.1 - Unauthenticated Information Exposure
Medium
CVE-2025-62984
WP AdCenter <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.