Medium
CVE-2025-12505
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-67948
SendPulse Email Marketing Newsletter <= 2.2.1 - Authenticated (Subscriber+) Information Exposure
High
CVE-2025-63076
The7 Elements < 2.7.12 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-12851
My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller
Medium
CVE-2025-13682
Trail Manager <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-13678
Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Critical
CVE-2025-12374
Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account Takeover
Medium
CVE-2025-13515
Nouri.sh Newsletter <= 1.0.1.3 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-12373
Torod – The smart shipping and delivery portal for e-shops and retailers <= 1.9 - Cross-Site Request Forgery To Plugin's Settings Modification
Medium
CVE-2025-12093
Voidek Employee Portal <= 1.0.7 - Missing Authorization
Medium
CVE-2025-13621
dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action
High
CVE-2025-12154
Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-12189
Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload
Critical
CVE-2025-13313
CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint
Medium
CVE-2025-13362
Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-68494
Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure
Medium
CVE-2025-62762
SMTP Mail <= 1.3.49 - Cross-Site Request Forgery
Medium
CVE-2025-62994
AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-63025
Xagio SEO <= 7.1.0.37 - Missing Authorization
Critical
CVE-2025-13390
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
Medium
CVE-2025-13354
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation
Medium
CVE-2025-13359
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2025-13342
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
Medium
CVE-2025-12887
Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.1 - Missing Authorization to Authenticated (Subscriber+) OAuth Token Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.