High
CVE-2025-47670
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Critical
CVE-2025-48126
Essential Real Estate <= 5.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-4611
Slim SEO <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via slim_seo_breadcrumbs Shortcode
Medium
CVE-2025-3781
Raisely Donation Form <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via raisely_donation_form Shortcode
High
CVE-2025-4803
Glossary by WPPedia <= 1.3.0 - Authenticated (Administrator+) PHP Object Injection
Critical
CVE-2025-47552
DZS Video Gallery <= 12.39 - Unauthenticated PHP Object Injection
Critical
CVE-2025-4524
Madara – Responsive and modern WordPress theme for manga sites <= 2.2.2 - Unauthenticated Local File Inclusion
Critical
CVE-2025-47568
ZoomSounds <= 6.91 - Unauthenticated PHP Object Injection
Critical
CVE-2025-48290
Multiple Themes by bslthemes <= Various Version - Unauthenticated Local File Inclusion
Critical
CVE-2025-39485
Grand Tour | Travel Agency WordPress <= 5.5.1 - Unauthenticated PHP Object Injection
Critical
CVE-2025-39503
Goodlayers Hotel <= 3.1.4 - Unauthenticated PHP Object Injection
Critical
CVE-2025-39500
Goodlayers Hostel <= 3.1.2 - Unauthenticated PHP Object Injection
Critical
CVE-2025-39495
Avantage <= 2.4.9 - Unauthenticated PHP Object Injection
Critical
CVE-2025-39499
Medicare <= 2.1.0 - Unauthenticated PHP Object Injection
High
CVE-2025-31924
Crafts & Arts <= 2.5 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2025-4322
Motors <= 5.6.67 - Unauthenticated Privilege Escalation via Password Update/Account Takeover
Medium
CVE-2025-48263
MultiVendorX <= 4.2.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-32292
Jarvis – Night Club, Concert, Festival WordPress <= 1.8.11 - Unauthenticated PHP Object Injection
Medium
CVE-2025-48280
AutomatorWP <= 5.2.1.3 - Authenticated (Administrator+) SQL Injection
Critical
CVE-2025-31049
Dash <= 1.3 - Unauthenticated PHP Object Injection
High
CVE-2025-60245
User Manager <= 2.9.12 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-3582
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Critical
CVE-2025-31430
The Business <= 1.6.1 - Unauthenticated PHP Object Injection
Medium
CVE-2025-48251
Additional Custom Emails & Recipients for WooCommerce <= 3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.