Medium
CVE-2025-8199
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-8687
Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets
Medium
CVE-2025-9856
Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9207
TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection
Medium
CVE-2025-8779
All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets
Critical
CVE-2025-10738
URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection
Medium
CVE-2025-12362
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval
High
CVE-2025-13094
WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-14508
MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion
Medium
CVE-2025-13705
Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter
Medium
CVE-2025-14539
Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter
Medium
CVE-2025-14378
Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-13077
افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection
Medium
CVE-2025-14394
Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update
Medium
CVE-2025-14395
Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions
Medium
CVE-2025-14462
Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14451
Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter
High
CVE-2025-14476
Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import
Medium
CVE-2025-14540
Userback <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Plugin's Configuration Exposure
Medium
CVE-2025-13092
Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Unauthenticated Information Expsoure
Medium
CVE-2025-13093
Devs CRM – Manage tasks, attendance and teams all together <= 1.1.8 - Missing Authorization to Unauthenticated Lead Tag Update
Critical
CVE-2025-14440
JAY Login & Register <= 2.4.01 - Authentication Bypass via Cookie
Medium
CVE-2025-14446
Popup Builder <= 1.1.37 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Reset
High
CVE-2025-14397
Postem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_users
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.