Medium
CVE-2025-12803
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-15267
Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode
Low
CVE-2026-1337
Neo4j Enterprise and Community editions have insufficient escaping of unicode characters in query log
Medium
CVE-2025-15396
Library Viewer < 3.2.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-25330
PublishPress Authors <= 4.10.1 - Missing Authorization
Medium
CVE-2026-31919
Advanced Coupons for WooCommerce Coupons <= 4.7.1 - Missing Authorization
Medium
CVE-2026-24951
myCred <= 2.9.7.3 - Missing Authorization
Medium
CVE-2026-1293
Yoast SEO <= 26.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'yoast-schema' Block Attribute
Critical
CVE-2026-25641
@nyariv/sandboxjs vulnerable to sandbox escape via TOCTOU bug on keys in property accesses
Critical
CVE-2026-25587
@nyariv/sandboxjs has a Sandbox Escape vulnerability
Critical
CVE-2026-25586
@nyariv/sandboxjs has Sandbox Escape via Prototype Whitelist Bypass and Host Prototype Pollution
Medium
CVE-2026-25574
payload-preferences has Cross-Collection IDOR in Access Control (Multi-Auth Environments)
Critical
CVE-2026-25544
@payloadcms/drizzle has SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters
Critical
CVE-2026-25520
@nyariv/sandboxjs has a Sandbox Escape issue
High
CVE-2026-1499
WP Duplicate <= 1.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via 'process_add_site' AJAX Action
Medium
CVE-2026-1252
Events Listing Widget <= 1.3.4 - Authenticated (Author+) Stored Cross-Site Scripting via Event URL Field
Medium
CVE-2026-1785
Code Snippets <= 3.9.4 - Cross-Site Request Forgery to Cloud Snippet Download/Update Actions
Medium
CVE-2026-1279
Employee Directory <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form_title' Shortcode Attribute
Low
CVE-2025-68458
webpack buildHttp: allowedUris allow-list bypass via URL userinfo (@) leading to build-time SSRF behavior
Medium
CVE-2026-1888
Docus <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Low
CVE-2025-68157
webpack buildHttp HttpUriPlugin allowedUris bypass via HTTP redirects → SSRF + cache persistence
Medium
CVE-2026-1909
WaveSurfer-WP <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'src' Shortcode Attribute
Medium
CVE-2026-1808
Orange Confort+ accessibility toolbar for WordPress <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Low
CVE-2025-70792
Microweber Cross-site Scripting vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.