Medium
CVE-2025-68851
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-68025
Addonify Floating Cart For WooCommerce <= 1.2.17 - Missing Authorization
High
CVE-2025-67988
CozyStay < 1.9.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68862
Woo File Dropzone <= 1.1.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2026-25329
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization
High
CVE-2025-69377
User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-67990
GMap Targeting <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-68026
LC Wizard <= 2.1.1 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-68028
GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization
High
CVE-2025-69378
Product Filter for WooCommerce <= 9.1.2 - Authenticated (Shop Manager+) Privilege Escalation
High
CVE-2025-69374
Eleblog – Elementor Blog And Magazine Addons <= 2.0.3 - Unauthenticated Local File Inclusion
Low
CVE-2026-22254
Winter CMS has Stored Cross-site Scripting (XSS) in Asset Manager
Medium
CVE-2025-14079
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
High
CVE-2026-1294
All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
Medium
CVE-2026-1271
ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification
Critical
CVE-2026-25632
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
Medium
CVE-2026-1654
Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2026-25631
n8n's domain allowlist bypass enables credential exfiltration
Medium
CVE-2025-13416
ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension
Critical
CVE-2026-25630
survey-pdf Upgraded jsPDF Version Due to Security Vulnerability
High
CVE-2026-25593
OpenClaw vulnerable to Unauthenticated Local RCE via WebSocket config.apply
High
CVE-2026-25536
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
High
CVE-2026-25546
godot-mcp has Command Injection via unsanitized projectPath
Critical
CVE-2026-25115
n8n has a Python sandbox escape
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.