Medium
CVE-2025-48251
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-48249
EAN for WooCommerce <= 5.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48255
Broadcast Live Video – Live Streaming : WebRTC, HLS, RTSP, RTMP <= 6.2.4 - Cross-Site Request Forgery
Medium
CVE-2025-48272
WP Job Portal <= 2.3.2 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-48248
Sitewide Discount for WooCommerce: Apply Discount to All Products <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48259
WP Mapa Politico España <= 3.8.0 - Cross-Site Request Forgery
Critical
CVE-2025-31069
HotStar – Multi-Purpose Business Theme <= 1.4 - Unauthenticated PHP Object Injection
Medium
CVE-2025-48257
Projectopia <= 5.1.17 - Missing Authorization
Medium
CVE-2025-3581
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-2892
All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
Medium
CVE-2025-60247
Bux Woocommerce <= 1.2.3 - Missing Authorization
Medium
CVE-2025-3715
Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter
Medium
CVE-2025-4669
Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
Medium
CVE-2025-4610
WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode
High
CVE-2025-3812
WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2025-4389
Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-4391
Echo RSS Feed Post Generator <= 5.4.8.1 - Unauthenticated Arbitrary File Upload
High
CVE-2025-48134
WP Tabs <= 2.2.12 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2025-47512
Tainacan <= 0.21.14 - Unauthenticated Arbitrary File Deletion
High
CVE-2024-13613
Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2025-3888
Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
Medium
CVE-2025-48116
EventON <= 2.4.4 - Missing Authorization
Medium
CVE-2025-47619
6Storage Rentals <= 2.19.4 - Missing Authorization
Medium
CVE-2025-39498
Spotlight - Social Media Feeds (Premium) <= 1.7.1 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.