High
CVE-2025-49386
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Medium
CVE-2025-4684
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets
High
CVE-2025-52737
Store Locator <= 2.2.260 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2025-52732
Google Map Targeting <= 1.1.6 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-54686
Exertio <= 1.3.2 - Unauthenticated PHP Object Injection
Medium
CVE-2025-47536
Content Egg <= 7.0.0 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2025-60188
Atarim <= 4.2.1 - Unauthenticated Information Exposure
Critical
CVE-2025-60187
Atarim <= 4.2.1 - Unauthenticated Arbitrary File Upload
High
CVE-2025-54014
MediCenter - Health Medical Clinic <= 15.1 - Unauthenticated PHP Object Injection
Critical
CVE-2025-60195
Atarim <= 4.2.1 - Unauthenticated Privilege Escalation
High
CVE-2025-7695
Dataverse Integration 2.77 - 2.81 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via reset_password_link REST Route
Medium
CVE-2025-7658
Temporarily Hidden Content <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-53990
JetFormBuilder <= 3.5.1.2 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-7359
Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block
High
CVE-2025-31422
Visual Art | Gallery WordPress Theme <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-60232
KBx Pro Ultimate <= 8.0.5 - Unauthenticated PHP Object Injection
High
CVE-2025-28961
URL Shortener <= 3.0.7 - Unauthenticated PHP Object Injection
High
CVE-2025-7504
Friends 3.5.1 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-4406
wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
High
CVE-2025-6742
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion
High
CVE-2025-24777
Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-52803
Sala <= 1.1.3 - Missing Authorization
Critical
CVE-2025-4606
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
High
CVE-2025-53560
Noisa <= 2.6.0 - Authenticated (Subscriber+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.