High
CVE-2025-60063
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2025-60064
Renewal <= 1.2.2 - Unauthenticated Local File Inclusion
High
CVE-2025-60065
Pinevale <= 1.0.14 - Unauthenticated Local File Inclusion
High
CVE-2025-60067
Giardino <= 1.1.10 - Unauthenticated Local File Inclusion
High
CVE-2025-60066
Katelyn <= 1.0.10 - Unauthenticated Local File Inclusion
High
CVE-2025-59564
EduMall < 4.4.5 - Unauthenticated Local File Inclusion
High
CVE-2025-60071
Riode | Multi-Purpose WooCommerce <= 1.6.23 - Unauthenticated Local File Inclusion
High
CVE-2025-53586
WeMusic <= 1.9.1 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-64223
PenNews < 6.7.3 - Unauthenticated Local File Inclusion
High
CVE-2025-54719
Yogi - Health Beauty & Yoga <= 2.9.2 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-60069
MinimogWP <= 3.9.6 - Unauthenticated Local File Inclusion
Critical
CVE-2025-7710
Brave Conversion Engine (PRO) <= 0.7.7 - Authentication Bypass to Administrator
Medium
CVE-2025-6832
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0 - Reflected Cross-Site Scripting
High
CVE-2025-6754
SEO Metrics <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
High
CVE-2025-49386
Preserve Code Formatting <= 4.0.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-4684
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets
Medium
CVE-2025-7646
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-4523
IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function
High
CVE-2025-7725
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-52737
Store Locator <= 2.2.260 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2025-52732
Google Map Targeting <= 1.1.6 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-54686
Exertio <= 1.3.2 - Unauthenticated PHP Object Injection
Medium
CVE-2025-54748
MapSVG < 8.6.12 - Authenticated (Contributor+) Arbitrary File Download
Medium
CVE-2025-7205
GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.