Critical
CVE-2025-11849
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-59134
Sale! Immigration law, Visa services support, Migration Agent Consulting <= 1.5.8 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-11270
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64189
XStore Core < 5.6 - Reflected Cross-Site Scripting
Medium
CVE-2025-48087
Memberlite Shortcodes <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11742
WPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-11926
Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-11857
XX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10187
GSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection
Medium
CVE-2025-62965
Admin Management Xtended <= 2.5.1 - Missing Authorization
Medium
CVE-2025-62966
GoCache <= 1.3.6 - Missing Authorization
High
CVE-2025-62427
Angular SSR has a Server-Side Request Forgery (SSRF) flaw
Medium
CVE-2025-11895
Binary MLM Plan <= 5.1 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2025-62414
bagisto has Cross Site Scripting (XSS) in Create New Customer
Critical
CVE-2025-62417
bagisto has CSV Formula Injection in Create New Product
Medium
CVE-2025-62418
bagisto has a Cross Site Scripting (XSS) vulnerability in TinyMCE Image Upload (SVG)
Medium
CVE-2025-62416
bagisto has Server Side Template Injection (SSTI) in Product Description
Low
CVE-2025-62412
LibreNMS alert-rules has a Cross-Site Scripting Vulnerability
Low
CVE-2025-61924
PrestaShop Checkout Target PayPal merchant account hijacking from backoffice
Medium
CVE-2025-61923
PrestaShop Checkout Backoffice directory traversal allows arbitrary file disclosure
High
CVE-2025-53092
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
Medium
CVE-2025-25298
Strapi Password Hashing is Missing Maximum Password Length Validation
Medium
CVE-2025-11842
Smidge is vulnerable to Path Traversal
High
CVE-2024-56143
Strapi Allows Unauthorized Access to Private Fields via parms.lookup
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.