High
CVE-2025-6742
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-5678
Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter
Medium
CVE-2025-3780
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification
High
CVE-2025-24777
Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-59558
Billey < 2.1.6 - Unauthenticated Local File Inclusion
Critical
CVE-2025-4606
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
High
CVE-2025-53560
Noisa <= 2.6.0 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-24779
Yogi < 2.9.3 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-60211
WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2025-6746
WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-7327
Widget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion
Medium
CVE-2025-5570
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
High
CVE-2025-30973
CoSchool LMS <= 1.4.3 - Unauthenticated PHP Object Injection
High
CVE-2025-30936
Torod <= 1.9 - Unauthenticated SQL Injection
High
CVE-2025-30949
Site Chat on Telegram <= 1.0.4 - Unauthenticated PHP Object Injection
High
CVE-2025-47571
Super Store Finder < 6.8 - Unauthenticated Local File Inclusion
Medium
CVE-2025-28955
Easy Video Player Wordpress & WooCommerce <= 10.0 - Unauthenticated Arbitrary File Download
High
CVE-2025-60238
UNIVERSAM < 9.08 - Unauthenticated PHP Object Injection
High
CVE-2025-48300
Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload
High
CVE-2025-60224
Subscribe to Download <= 2.0.9 - Unauthenticated PHP Object Injection
Medium
CVE-2025-29012
CF7 7 Mailchimp Add-on < 2.4 - Missing Authorization
Medium
CVE-2024-11937
Premium Addons for Elementor <= 4.10.69 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6814
Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function
High
CVE-2025-49870
Paid Member Subscriptions <= 2.15.1 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.