High
CVE-2025-53565
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-54015
HT Contact Form 7 <= 2.0.0 - Authenticated (Administrator+) Local File Inclusion
Medium
CVE-2025-54016
Videopack <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-30635
IDonatePro <= 2.1.8 - Unauthenticated Local File Inclusion
High
CVE-2025-6993
Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
High
CVE-2025-6043
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-31422
Visual Art | Gallery WordPress Theme <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-60203
Store Exporter <= 2.7.6 - Unauthenticated Local File Inclusion
High
CVE-2025-60232
KBx Pro Ultimate <= 8.0.5 - Unauthenticated PHP Object Injection
High
CVE-2025-60204
WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion
Critical
CVE-2025-5394
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Medium
CVE-2025-49957
Email Attachment by Order Status & Products <= 1.0.1 - Reflected Cross-Site Scripting
High
CVE-2025-60240
AnyComment <= 0.3.6 - Unauthenticated Local File Inclusion
High
CVE-2025-1313
Nokri - Job Board WordPress Theme <= 1.6.3 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Medium
CVE-2025-7518
RSFirewall! <= 1.1.42 - Authenticated (Admin+) Arbitrary File Read
High
CVE-2025-28961
URL Shortener <= 3.0.7 - Unauthenticated PHP Object Injection
High
CVE-2025-7504
Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-5921
SureForms <= 1.7.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-48291
Contest Gallery <= 26.0.6 - Reflected Cross-Site Scripting
High
CVE-2025-7442
WPGYM - Wordpress Gym Management System < 67.8.0 - Unauthenticated SQL Injection
Medium
CVE-2025-6716
Contest Gallery <= 26.0.8 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2025-49950
Official Integration for Billingo <= 4.2.5 - Authenticated (Shop Manager+) Privilege Escalation
High
CVE-2025-59555
Medizin < 1.9.7 - Unauthenticated Local File Inclusion
High
CVE-2025-6691
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.