Medium
CVE-2025-14802
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-14792
Key Figures <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting via kf_field_figure_default_color_render
Medium
CVE-2025-13369
Premmerce WooCommerce Customers Manager <= 1.1.14 - Reflected Cross-Site Scripting
High
CVE-2025-13371
Money Space <= 2.13.9 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14370
Quote Comments <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
Medium
CVE-2025-14904
Newsletter Email Subscribe <= 2.4 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14875
HBLPAY Payment Gateway for WooCommerce <= 5.0.0 - Reflected Cross-Site Scripting via 'cusdata' Parameter
Medium
CVE-2025-14867
Flashcard Plugin for WordPress <= 0.9 - Authenticated (Contributor+) Arbitrary File Read via Path Traversal
Medium
CVE-2025-14887
twinklesmtp – Email Service Provider For WordPress <= 1.03 - Authenticated (Administrator+) Stored Cross-Site Scripting via Sender Settings
Medium
CVE-2025-14888
Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field
Medium
CVE-2025-13657
HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args
High
CVE-2026-0656
iPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure
Medium
CVE-2025-14845
NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14842
Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload
Medium
CVE-2025-14901
Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay
High
CVE-2025-14835
WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
Medium
CVE-2025-14468
AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission
Medium
CVE-2025-14891
Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
Medium
CVE-2025-14059
EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal
Medium
CVE-2025-12648
WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files
High
CVE-2026-24635
EduBlink Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-67930
eHive Search <= 2.5.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-22483
teachPress <= 9.0.12 - Cross-Site Request Forgery
Medium
CVE-2026-23804
Better Business Reviews <= 0.1.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.