High
CVE-2025-7689
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,329
Reset filters
Critical
CVE-2025-6715
LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion
Medium
CVE-2025-6261
Fleetwire Fleet Management Plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list Shortcode
Medium
CVE-2025-7965
CBX Restaurant Booking <= 1.2.1 - Cross-Site Request Forgery to Plugin Reset
Medium
CVE-2025-54036
Webba Booking <= 5.1.20 - Cross-Site Request Forgery
Medium
CVE-2025-54040
Webba Booking <= 5.1.20 - Missing Authorization
Medium
CVE-2025-49951
gAppointments <= 1.14.1 - Reflected Cross-Site Scripting
Critical
CVE-2025-6058
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
High
CVE-2025-52714
Traveler < 3.2.2 - Unauthenticated SQL Injection
Medium
CVE-2025-6976
Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
High
CVE-2025-6970
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
Medium
CVE-2025-6975
Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
Medium
CVE-2025-3780
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification
High
CVE-2025-24777
Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-52804
Nuss <= 1.3.3 - Missing Authorization
Medium
CVE-2025-52787
Tennis Court Bookings <= 1.2.7 - Reflected Cross-Site Scripting
Critical
CVE-2025-23970
Service Finder Booking <= 6.0 - Unauthenticated Privilege Escalation
High
CVE-2025-6814
Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function
Medium
CVE-2026-15289
Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'
Medium
CVE-2025-48231
Booking Calendar Contact Form <= 1.2.58 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2025-53259
Hotel Booking <= 3.7 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-49321
Eventin <= 4.0.28 - Reflected Cross-Site Scripting
High
CVE-2025-52814
BRW <= 1.8.7 - Unauthenticated Local File Inclusion
High
CVE-2025-52827
Nuss <= 1.3.3 - Authenticated (Subscriber+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.