Medium
CVE-2025-7835
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-6262
muse.ai video embedding <= 0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via muse-ai Shortcode
Medium
CVE-2025-7690
Affiliate Plus <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Critical
CVE-2025-6380
ONLYOFFICE Docs 1.1.0 - 2.2.0 - Missing Authorization to Unauthenticated Privilege Escalation via callback Function
Medium
CVE-2025-6385
WP Applink <= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
Critical
CVE-2025-6441
Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 4.03.32 - Unauthenticated Login Token Generation to Authentication Bypass
Medium
CVE-2025-6387
WP Get The Table <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via url Parameter
Medium
CVE-2025-7966
Get Youtube Subs <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via subscribe_link_att Function
Medium
CVE-2025-7959
Station Pro <= 2.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via width and height Parameters
Medium
CVE-2025-7822
WP Wallcreeper <= 1.6.1 - Missing Authorization to Authenticated (Susbcriber+) Cache Enable/Disable
Medium
CVE-2025-5084
Post Grid Master <= 3.4.13 - Reflected Cross-Site Scripting via argsArray['read_more_text']
Medium
CVE-2025-6539
Voltax Video Player <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Medium
CVE-2025-8071
Mine CloudVod <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via audio Parameter
Medium
CVE-2025-4608
Structured Content <= 1.6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode
Medium
CVE-2025-7780
AI Engine <= 2.9.4 - Missing URL Scheme Validation to Authenticated (Subscriber+) Arbitrary File Read via simpleTranscribeAudio and get_audio Functions
High
CVE-2025-7695
Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route
Critical
CVE-2025-7437
Ebook Store <= 5.8012 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-7852
WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
Medium
CVE-2025-52734
CropRefine <= 1.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-50053
Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App <= 0.8.8.8 - Reflected Cross-Site Scripting
Critical
CVE-2025-6715
LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion
High
CVE-2025-48171
Cena Store <= 2.11.26 - Unauthenticated Local File Inclusion
Medium
CVE-2025-53201
Jobmonster <= 4.7.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-53559
Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.