Medium
CVE-2025-28868
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-28875
BP Email Assign Templates <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-28908
pipDisqus <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-1527
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Module
Medium
CVE-2025-28879
Bee Layer Slider <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-28922
Go To Top <= 0.0.8 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-28870
amoCRM WebForm <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-26565
GNUPress <= 0.2.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-28895
Custom top bar <= 2.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-28864
Builder for Contact Form 7 by Webconstruct <= 1.2.2 - Cross-Site Request Forgery
Medium
CVE-2024-12589
Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timer
Medium
CVE-2025-28930
List Mixcloud <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-28901
Members page only for logged in users <= 1.4.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-28943
DP ALTerminator - Missing ALT manager <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-10107
Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-1707
Review Schema <= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Medium
CVE-2025-28936
Lunar <= 1.3.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-26536
Another Events Calendar <= 1.7.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-28914
wordpress login form to anywhere <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-28866
Login Logger <= 1.2.1 - Cross-Site Request Forgery
Medium
CVE-2025-28937
Lava Ajax Search <= 1.1.9 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-28871
Block Spam By Math Reloaded <= 2.2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-43228
SecuPress Free <= 2.2.5.3 - Missing Authorization
Medium
CVE-2025-28874
BP Email Assign Templates <= 1.7 - Authenticated (Admin+) Arbitrary Option Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.