Medium
CVE-2025-64268
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-66071
Custom Order Numbers for WooCommerce <= 1.11.0 - Missing Authorization
Medium
CVE-2025-12696
HelloLeads CRM Form Shortcode <= 1.0 - Missing Authorization to Unauthenticated Settings Reset
High
CVE-2025-13526
OneClick Chat to Order <= 1.0.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-13318
Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
Medium
CVE-2025-13136
GSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure
Medium
CVE-2025-12877
IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Medium
CVE-2025-62609
MLX has Wild Pointer Dereference in load_gguf()
Medium
CVE-2025-62608
MLX has heap-buffer-overflow in load()
Medium
CVE-2025-13317
Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter
High
CVE-2025-13384
CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
Medium
CVE-2025-12752
Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation
Medium
CVE-2025-11186
Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-11087
Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2025-10684
Construction Light <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
Medium
CVE-2025-67584
GoDAM <= 1.4.6 - Missing Authorization
Medium
CVE-2025-67598
SupportCandy <= 3.4.1 - Cross-Site Request Forgery
Medium
CVE-2025-14314
PopupKit <= 2.1.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-67474
ForumWP <= 2.1.4 - Missing Authorization
Medium
CVE-2025-66077
Legal Pages <= 1.4.6 - Missing Authorization
Medium
CVE-2025-9116
WPS Visitor Counter <= 1.4.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-67929
TI WooCommerce Wishlist <= 2.10.0 - Missing Authorization
Medium
CVE-2025-66064
Giveaways and Contests by RafflePress <= 1.12.20 - Cross-Site Request Forgery
Medium
CVE-2025-63700
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.