High
CVE-2025-14613
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-15021
Gotham Block Extra Light <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2025-15020
Gotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode
Medium
CVE-2025-14389
WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update
Medium
CVE-2025-14880
Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-0678
Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter
Medium
CVE-2025-12178
SpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-14482
Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Medium
CVE-2026-0680
Real Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Medium
CVE-2025-13627
Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting
Medium
CVE-2025-14725
Internal Link Builder <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings
Medium
CVE-2026-0717
LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2026-0635
Responsive Accordion Slider <= 1.2.2 - Missing Authorization to Authenticated (Contributor+) Slider Update via 'resp_accordion_silder_save_images'
Medium
CVE-2025-14464
PDF Resume Parser <= 1.0 - Unauthenticated Sensitive Information Disclosure in SMTP Credentials
Medium
CVE-2025-14854
WP-CRM System – Manage Clients and Projects <= 3.4.5 - Missing Authorization to Authenticated (Subscriber+) CRM Data Exposure and Task Modification
Medium
CVE-2026-0694
SearchWiz <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title
Medium
CVE-2025-14379
Testimonials Creator 1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-15486
Kunze Law <= 2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2026-24607
Travel Monster <= 1.3.3 - Missing Authorization
High
CVE-2025-68913
Miion <= 1.2.7 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-68905
JNews - Pay Writer <= 11.0.0 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-68903
Anona <= 8.0 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2025-69097
WPLMS <= 1.9.9.5.4 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-68912
HDForms <= 1.6.1 - Unauthenticated Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.