Medium
CVE-2025-10304
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-12585
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
Critical
CVE-2025-13542
DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation
High
CVE-2025-13516
SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-13696
Zigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint
Medium
CVE-2025-12483
Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-13606
Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
High
CVE-2025-13387
Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-10019
Contact Form Email <= 1.3.60 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-13534
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action
High
CVE-2025-63017
WerkStatt <= 1.6.6 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-64639
Compress for MainWP <= 6.50.07 - Missing Authorization
Medium
CVE-2025-62152
ConveyThis <= 269.2 - Missing Authorization
Medium
CVE-2025-62085
BERTHA AI <= 1.13 - Missing Authorization
Medium
CVE-2025-67545
FireBox <= 3.1.0-free - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-66534
The Aisle <= 2.9 - Missing Authorization
Medium
CVE-2025-13378
AI ChatBot with ChatGPT and Content Generator by AYS <= 2.7.0 - Unauthenticated Server-Side Request Forgery via 'pinecone_url' Parameter
Medium
CVE-2025-12123
Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting
Critical
CVE-2025-13540
Tiare Membership <= 1.2 - Unauthenticated Privilege Escalation
Critical
CVE-2025-13675
Tiger <= 101.2.1 - Unauthenticated Privilege Escalation
Critical
CVE-2025-13539
FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login
Critical
CVE-2025-13538
FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
Medium
CVE-2025-9191
Houzez <= 4.1.6 - Authenticated (Subscriber+) PHP Object Injection via Saved Search
Medium
CVE-2025-64295
All In One SEO Pack <= 4.8.6.1 - Authenticated (Subscriber+) Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.