Medium
CVE-2025-12825
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2026-1096
Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute
High
CVE-2025-14478
Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
High
CVE-2025-67941
The Aisle < 2.9.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25003
Client Portal – Private user pages and login <= 1.2.1 - Missing Authorization
Medium
CVE-2025-68859
Syntax Highlighter Compress <= 3.0.83.3 - Reflected Cross-Site Scripting
Critical
CVE-2026-23800
Modular DS 2.5.2 - Unauthenticated Privilege Escalation
Medium
CVE-2026-25005
Frontend File Manager Plugin <= 23.5 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-68016
onepay Payment Gateway For WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-0691
CM E-Mail Blacklist <= 1.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'black_email' Parameter
Medium
CVE-2025-68872
Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 - Reflected Cross-Site Scripting
Medium
CVE-2025-12984
Advanced Ads – Ad Manager & AdSense <= 2.0.15 - Authenticated (Admin+) SQL Injection
Critical
CVE-2025-10484
Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass
Medium
CVE-2025-67942
Peach Payments Gateway <= 3.3.6 - Missing Authorization
High
CVE-2025-67940
Powerlift < 3.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68871
Dooodl <= 2.3.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-68849
Quote Master <= 7.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-31413
Element Pack Elementor Addons <= 8.3.13 - Cross-Site Request Forgery
Medium
CVE-2026-24386
Element Invader – Template Kits for Elementor <= 1.2.4 - Missing Authorization
Medium
CVE-2025-68008
Mail <= 1.3 - Reflected Cross-Site Scripting
Low
ghsa-rwr8-xrpw-9qf5
solspace/craft-freeform Exposed to Known Axios Vulnerabilities via Precompiled Assets
Low
ghsa-44jg-mv3h-wj6g
solspace/craft-freeform Vulnerable to XSS in `PhpSpreadsheet` HTML Writer Due to Unsanitized Styling Data
High
CVE-2026-22775
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
Medium
CVE-2026-1002
Vert.x Web static handler component cache can be manipulated to deny the access to static files
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.