Unrated
CVE-2025-6677
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
Unrated
CVE-2025-6676
drupal/simple_sitemap - SA-CONTRIB-2025-083
Unrated
CVE-2025-6675
drupal/miniorange_2fa - SA-CONTRIB-2025-082
Unrated
CVE-2025-6674
drupal/ckeditor5_youtube - SA-CONTRIB-2025-081
Unrated
CVE-2025-5682
drupal/klaro - SA-CONTRIB-2025-080
Unrated
CVE-2025-48922
drupal/glightbox - SA-CONTRIB-2025-078
Unrated
CVE-2025-48923
drupal/toc_js - SA-CONTRIB-2025-077
Medium
CVE-2025-6546
Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter
High
CVE-2025-52888
Allure Report allows Improper XXE Restriction via DocumentBuilderFactory
Medium
CVE-2025-5275
Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
Medium
CVE-2025-5813
Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation
Medium
CVE-2025-6540
web-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter
Medium
CVE-2025-5932
Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-6537
Namasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter
Medium
CVE-2025-5929
The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter
Medium
CVE-2025-6538
Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Medium
CVE-2025-5812
VG WORT METIS <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
Medium
CVE-2025-6383
WP-PhotoNav <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode
Critical
CVE-2025-4334
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
Medium
CVE-2025-5564
GC Social wall <= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5540
Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-6258
WP SoundSystem <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode
Medium
CVE-2025-6378
Responsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode
Medium
CVE-2025-3863
Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.