High
CVE-2025-63076
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,638
Medium
CVE-2025-66066
Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-66526
Tablesome <= 1.1.34 - Missing Authorization
Medium
CVE-2025-62996
Custom Layouts – Post + Product grids made easy <= 1.4.12 - Missing Authorization
Medium
CVE-2025-63055
Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62738
Formstack Online Forms <= 2.0.2 - Missing Authorization
Medium
CVE-2025-67580
Constant Contact + WooCommerce <= 2.4.1 - Missing Authorization
Medium
CVE-2025-66528
Thank You Page Customizer for WooCommerce <= 1.1.8 - Missing Authorization
Medium
CVE-2025-62995
MultiParcels Shipping For WooCommerce <= 1.30.12 - Missing Authorization
Medium
CVE-2025-62865
Post Cloner <= 1.0.0 - Missing Authorization
Medium
CVE-2025-66086
SMS Alert Order Notifications <= 3.8.8 - Missing Authorization
Medium
CVE-2025-67470
Portfolio and Projects <= 1.5.5 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-62739
Add Custom Codes <= 4.80 - Cross-Site Request Forgery
High
CVE-2025-65959
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Medium
CVE-2025-13620
Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering
High
CVE-2025-12851
My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller
Medium
CVE-2025-13682
Trail Manager <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-12879
User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation
Medium
CVE-2025-12876
Projectopia – WordPress Project Management <= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
High
CVE-2025-13614
Cool Tag Cloud <= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13739
CryptX <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13678
Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13684
ARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12130
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.