Medium
CVE-2025-13359
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,642
Critical
CVE-2025-13342
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
Medium
CVE-2025-13109
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.2 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_query/woof_remove_query'
Medium
CVE-2025-12887
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
Medium
CVE-2025-67596
Business Directory <= 6.4.19 - Cross-Site Request Forgery
Medium
CVE-2025-66529
Chartify <= 3.6.3 - Cross-Site Request Forgery
Medium
CVE-2025-63024
Order Delivery Date for WooCommerce <= 4.3.1 - Missing Authorization
Critical
CVE-2025-13407
Gravity Forms <= 2.9.23.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-62090
Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons <= 3.0.2 - Missing Authorization
Medium
CVE-2025-63043
Post Grid and Gutenberg Blocks <= 2.3.19 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-12358
ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
Medium
CVE-2025-65657
FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management
High
CVE-2025-13827
GrapesJsBuilder File Upload allows all file uploads
Critical
CVE-2025-13828
Mautic user without privileged access to the Marketplace can install and uninstall composer packages
Critical
CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Medium
CVE-2025-65186
Grav CMS is vulnerable to Cross Site Scripting (XSS) in the page editor
High
CVE-2025-66414
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Medium
CVE-2025-64460
Django is vulnerable to DoS via XML serializer text extraction
Medium
CVE-2025-13372
Django is vulnerable to SQL injection in column aliases
Medium
CVE-2025-10304
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure
Medium
CVE-2025-13495
FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter
Medium
CVE-2025-12585
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
Medium
CVE-2025-13448
CSSIgniter Shortcodes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
High
CVE-2025-13646
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.