Medium
CVE-2025-8293
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-7439
Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link
Medium
CVE-2025-7440
Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link
Medium
CVE-2025-7668
Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-7651
Earnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-6221
Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
Medium
CVE-2025-7649
Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7684
Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-7683
LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-7664
Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function
Medium
CVE-2025-7686
weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Critical
CVE-2025-7441
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-8898
Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2025-8143
Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'
High
CVE-2025-49915
SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection
Medium
CVE-2024-8393
Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion
High
CVE-2025-60062
tPlayer <= 1.2.1.6 - Unauthenticated SQL Injection
Medium
CVE-2025-49897
Vertical scroll slideshow gallery v2 <= 9.1 - Authenticated (Contributor+) SQL Injection
High
CVE-2025-8105
Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-49432
Ultimate Video Player <= 10.1 - Missing Authorization
Medium
95550fd3-13e5-4341-8551-efe9070b0ada
WP Discord Post Plus - Supports Unlimited Channels <= 1.0.2 - Cross-Site Request Forgery
Medium
CVE-2025-8878
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-49896
School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference
High
CVE-2025-8142
Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.