High
CVE-2025-15055
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-15019
BIALTY - Bulk Image Alt Text (Alt tag, Alt Attribute) with Yoast SEO + WooCommerce <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-14980
BetterDocs <= 4.3.3 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2025-14893
IndieWeb <= 4.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via 'Telephone' Parameter
Medium
CVE-2025-14782
Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.49.1 - Missing Authorization to Authenticated (Forminator User+) CSV Export
Critical
CVE-2025-14736
Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
Medium
CVE-2025-14718
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.3 - Missing Authorization to Authenticated (Contributor+) Workflow Manipulation
Medium
CVE-2025-14720
Booking for Appointments and Events Calendar – Amelia <= 1.2.38 - Missing Authorization to Unauthenticated Multiple AJAX Actions
Medium
CVE-2025-14574
weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.1.15 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-13749
Clearfy <= 2.4.0 - Cross-Site Request Forgery to Update Notification Tampering
Medium
CVE-2025-14886
Japanized for WooCommerce <= 2.7.17 - Missing Authorization to Unauthenticated Order Status Modification
High
CVE-2025-14436
Brevo for WooCommerce <= 4.0.49 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-15481
Notification Bar for WordPress <= 1.1.8 - Unauthenticated Information Exposure
Medium
CVE-2025-22728
Workreap (theme's plugin) <= 3.3.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-58913
VideoPro <= 2.3.8.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-0676
Zorka <= 1.5.7 - Missing Authorization
Medium
CVE-2025-50005
tagDiv Composer <= 5.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-47666
Image&Video FullScreen Background <= 1.6.7 - Reflected Cross-Site Scripting
Critical
CVE-2025-14975
Custom Login Page Customizer <= 2.5.3 - Unauthenticated Privilege Escalation via Password Reset
Medium
CVE-2025-32123
HTML5 Video Player with Playlist & Multiple Skins <= 5.3.5 - Reflected Cross-Site Scripting
Medium
CVE-2026-24353
User Registration <= 4.4.9 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
High
CVE-2025-49994
Athens <= 1.1.6 - Unauthenticated Local File Inclusion
High
CVE-2025-23993
Felan Framework <= 1.1.3 - Unauthenticated SQL Injection
Medium
CVE-2025-27005
HTML5 Video Player <= 5.3.5 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.