High
CVE-2025-5071
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Critical
CVE-2025-1562
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
Medium
CVE-2025-3880
Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update
Critical
CVE-2025-49330
Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.3.0 - Unauthenticated PHP Object Injection
High
CVE-2025-4200
Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-4187
UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-4592
AI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update
Medium
CVE-2025-6070
Restrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2025-5487
AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions
Medium
CVE-2025-49916
MultiVendorX <= 4.2.23 - Missing Authorization
Medium
CVE-2025-49868
Automation By Autonami <= 3.6.0 - Open Redirect
Medium
CVE-2025-49871
Noptin <= 3.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2025-32549
WPGYM <= 65.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-47572
School Management <= 93.0.0 - Authenticated (Student+) Local File Inclusion
Medium
CVE-2025-7772
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 16.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2025-49854
Slim SEO <= 4.5.4 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-6003
WordPress Single Sign-On (SSO) - Multiple Versions - Incorrect Authorization to Sensitive Information Exposure
Critical
CVE-2025-4973
Workreap <= 3.3.1 - Authentication Bypass via 'workreap_verify_user_account'
Critical
CVE-2025-49508
CozyStay < 1.7.1 - Unauthenticated Local File Inclusion
Critical
CVE-2025-49256
Sapa <= 1.1.14 - Unauthenticated Local File Inclusion
High
CVE-2025-48274
WP Job Portal <= 2.3.2 - Unauthenticated SQL Injection
Critical
CVE-2025-29002
Simen <= 4.6 - Unauthenticated Local File Inclusion
Critical
CVE-2025-49254
Nika <= 1.2.8 - Unauthenticated Local File Inclusion
Critical
CVE-2025-49257
Zota <= 1.3.8 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.