Medium
CVE-2025-4775
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
Medium
CVE-2025-48111
YITH PayPal Express Checkout for WooCommerce <= 1.49.0 - Cross-Site Request Forgery
Medium
CVE-2025-3880
Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update
Medium
CVE-2025-49929
Ultimate Blocks <= 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-49330
Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.3.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-49234
WP Dummy Content Generator <= 3.4.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
Medium
CVE-2025-49316
WP2LEADS <= 3.5.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-52762
flexo-posts-manager <= 1.0001 - Reflected Cross-Site Scripting
Medium
CVE-2025-52764
flexoslider <= 1.0004 - Reflected Cross-Site Scripting
Medium
CVE-2026-28136
SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection
Critical
CVE-2025-49596
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
Medium
CVE-2025-5337
Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter
Low
CVE-2025-49597
handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution
Medium
CVE-2025-5238
YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-49585
XWiki does not require right warnings for XClass definitions
High
CVE-2025-49586
XWiki allows remote code execution through preview of XClass changes in AWM editor
Medium
CVE-2025-49587
XWiki does not require right warnings for notification displayer objects
High
CVE-2025-49584
XWiki makes title of inaccessible pages available through the class property values REST API
Medium
CVE-2025-49583
XWiki provides no warning when granting XWiki.Notifications.Code.NotificationEmailRendererClass admin right
High
CVE-2025-49581
XWiki allows remote code execution through default value of wiki macro wiki-type parameters
High
CVE-2025-49582
XWiki's required right warnings for macros are incomplete
Medium
CVE-2025-4667
Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
High
CVE-2025-49580
XWiki allows privilege escalation through link refactoring
Medium
CVE-2025-5589
StreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.