Medium
CVE-2025-11891
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Critical
CVE-2025-11457
EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-11986
Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State
Medium
CVE-2025-11988
Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion
Medium
CVE-2025-12020
Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-68065
Hub Core <= 5.0.8 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-66055
Email Subscribers & Newsletters <= 5.9.10 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-11967
Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2025-12498
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
Medium
CVE-2025-11972
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection
Medium
CVE-2025-12042
Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export
High
CVE-2025-12099
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
High
CVE-2025-9334
Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection
Medium
CVE-2025-66056
Uncanny Automator < 6.10.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-63006
EventPrime <= 4.2.4.1 - Missing Authorization
Medium
CVE-2025-63007
EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-12520
WP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-64373
Traveler < 3.2.6 - Unauthenticated Local File Inclusion
Medium
CVE-2025-12360
Better Find and Replace <= 1.7.7 - Missing Authorization
Medium
CVE-2025-10691
Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion
Medium
CVE-2025-10683
Easy Email Subscription <= 1.3 - Authenticated (Admin+) SQL Injection via uid
High
CVE-2025-12497
Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]
Medium
CVE-2025-12468
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12192
The Events Calendar <= 6.15.9 - Sysinfo Key Incorrect Comparison to Unauthenticated Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.