Medium
CVE-2025-66098
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2026-27440
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program. <= 2.9.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49902
Login Page Customizer – Customizer Login Page, Admin Page, Custom Design <= 2.1.1 - Missing Authorization
Medium
CVE-2025-64262
Auto Prune Posts <= 3.0.0 - Cross-Site Request Forgery
Medium
CVE-2025-66055
Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2025-64263
Content Pilot <= 2.1.7 - Missing Authorization
Medium
CVE-2025-66075
Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization
Medium
CVE-2025-63030
New User Approve <= 3.2.3 - Cross-Site Request Forgery
Medium
CVE-2025-67590
Ultimate FAQ <= 2.4.3 - Cross-Site Request Forgery
Low
CVE-2025-64481
Open redirect endpoint in Datasette
High
CVE-2025-12399
Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload
High
CVE-2025-11967
Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2025-11980
Quick Featured Images <= 13.7.3 - Authenticated (Editor+) SQL Injection via delete_orphaned
Medium
CVE-2025-11448
Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion
Medium
CVE-2025-12092
CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion
Medium
CVE-2025-12837
aThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget
Medium
CVE-2025-12643
Saphali LiqPay for donate <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Medium
CVE-2025-7663
Ovatheme Events Manager <= 1.8.6 - Missing Authorization
Medium
CVE-2025-12193
Mang Board WP <= 2.3.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-12000
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
Medium
CVE-2025-12353
WPFunnels <= 3.6.2 - Unauthorized User Registration
Medium
CVE-2025-12112
Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.