Medium
CVE-2025-65013
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-13085
SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure
Medium
CVE-2025-65012
Kirby CMS has cross-site scripting (XSS) in the changes dialog
Medium
CVE-2025-12535
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
High
CVE-2025-13145
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import
Medium
CVE-2025-54990
XWiki AdminTools application doesn't set permissions on the AdminTools space
Medium
CVE-2025-12878
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wfop_phone Shortcode
High
CVE-2026-15291
Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12814
SiteSEO – SEO Simplified <= 1.3.2 - Improper Authorization to Authenticated Settings Reset
High
CVE-2025-12646
Community Events <= 1.5.4 - Unauthenticated SQL Injection
Medium
CVE-2025-12751
WSChat – WordPress Live Chat <= 3.1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
Medium
CVE-2025-12842
Booking Plugin for WordPress Appointments – Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending
Medium
CVE-2025-12822
WP Login and Register using JWT <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) API Key Exposure
Medium
CVE-2025-12359
Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2025-13054
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12349
Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger
Medium
CVE-2025-12426
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12770
New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling
Medium
CVE-2025-6251
Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12777
YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion
Medium
CVE-2025-12427
YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename
Medium
CVE-2025-12545
Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure
Medium
CVE-2025-12376
Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-8084
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.