Medium
CVE-2025-28976
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-5937
MicroPayments – Fans Paysite: Paid Creator Subscriptions, Digital Assets, Wallet <= 3.2.0 - Cross-Site Request Forgery to Settings Reset
Medium
CVE-2025-53264
ONet Regenerate Thumbnails <= 1.5 - Cross-Site Request Forgery
Medium
CVE-2025-53256
YaySMTP <= 2.6.6 - Authenticated (Administrator+) SQL Injection
High
CVE-2025-53259
Hotel Booking <= 3.7 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-53257
Gmedia Photo Gallery <= 1.23.0 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-53339
Devnex Addons For Elementor <= 1.0.9 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-53200
ChatBot <= 6.7.3 - Missing Authorization
Medium
CVE-2025-53282
Thumbnail Editor <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-53321
Raise The Money <= 5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-53298
Plugin Inspector <= 1.5 - Authenticated (Admin+) Arbitrary File Download
High
CVE-2025-53281
WPB Category Slider for WooCommerce <= 1.71 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-53327
Aioseo Multibyte Descriptions <= 0.0.6 - Cross-Site Request Forgery
High
CVE-2025-52828
Red Art <= 3.8 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-5398
Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI
Critical
CVE-2024-12827
DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset
Medium
CVE-2025-5275
Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
Medium
CVE-2025-5932
Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-3863
Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function
High
CVE-2023-25998
Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Unauthenticated Local File Inclusion
High
CVE-2025-28946
PrintXtore < 1.7.7 - Unauthenticated Local File Inclusion
High
CVE-2025-49280
Magty <= 1.0.6 - Unauthenticated Local File Inclusion
High
CVE-2025-49275
Blogbyte <= 1.1.1 - Unauthenticated Local File Inclusion
High
CVE-2025-49281
Magways <= 1.2.1 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.