Critical
ghsa-826p-4gcg-35vw
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
Medium
CVE-2025-2918
Ultimate Blocks – WordPress Blocks Plugin <= 3.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-4774
Premium Addons for Elementor <= 4.11.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Medium
CVE-2025-4577
Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute
Medium
CVE-2025-5897
@vue/cli-plugin-pwa Regular Expression Denial of Service vulnerability
Medium
CVE-2025-5896
taro-css-to-react-native Regular Expression Denial of Service vulnerability
Low
CVE-2025-5889
brace-expansion Regular Expression Denial of Service vulnerability
Low
CVE-2025-5891
pm2 Regular Expression Denial of Service vulnerability
High
CVE-2025-49141
HaxCMS-PHP Command Injection Vulnerability
Medium
CVE-2025-49139
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Critical
CVE-2025-49652
BackendAI Missing Authentication for Critical Function
High
CVE-2025-45001
react-native-keys insecurely stores encryption cipher and Base64 chunks
Medium
CVE-2025-49138
HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter
High
CVE-2025-49137
Hax CMS Stored Cross-Site Scripting vulnerability
Medium
CVE-2025-3076
Elementor Pro <= 3.29.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-4387
Abandoned Cart Pro for WooCommerce <= 9.16.0 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2025-4601
RH - Real Estate WordPress Theme <= 4.4.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-5925
Bunny’s Print CSS <= 0.95 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-49130
Laravel Translation Manager Vulnerable to Stored Cross-site Scripting
High
CVE-2025-47561
MapSVG < 8.6.13 - Authenticated (Contributor+) Privilege Esclation
High
CVE-2025-3745
WP Lightbox 2 <= 3.0.6.7 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2023-25999
BodyCenter - Gym, Fitness WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
High
CVE-2025-24767
TicketBAI Facturas para WooCommerce <= 3.19 - Unauthenticated SQL Injection
Critical
CVE-2025-23974
One-Login <= 1.4 - Unauthenticated Privilege Esclation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.