Medium
CVE-2025-11227
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-11228
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
Critical
CVE-2025-9485
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()
Medium
CVE-2025-9029
WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function
Medium
CVE-2025-9886
Trinity Audio <= 5.20.2 - Cross-Site Request Forgery
High
CVE-2025-62025
JobSearch < 3.0.8 - Unauthenticated PHP Object Injection
Medium
CVE-2025-9206
Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-9286
Appy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password
Critical
CVE-2025-7721
JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion
High
CVE-2025-9213
TextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover
Medium
CVE-2025-7825
Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation
Medium
CVE-2025-11241
Yoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58986
Jock On Air Now (JOAN) <= 6.0.4 - Missing Authorization
High
CVE-2025-49380
WooCommerce Vehicle Parts Finder <= 3.7 - Unauthenticated PHP Object Injection
Medium
CVE-2025-62912
SiteGround Email Marketing <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10735
Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery
Medium
CVE-2025-10744
File Manager, Code editor, backup by Managefy <= 1.6.1 - Unauthenticated Information Exposure
High
CVE-2025-10916
FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More < 1.0.4 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-7038
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
High
CVE-2025-9993
Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion
Critical
CVE-2025-9762
Post By Email <= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments
Medium
CVE-2025-8559
All in One Music Player <= 1.3.1 - Authenticated (Contributor+) Path Traversal via theme Parameter
High
CVE-2025-9991
Tiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion
Critical
CVE-2025-8625
Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.