Medium
CVE-2025-14454
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-12512
GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata
Medium
CVE-2025-10289
Filter & Grids <= 3.2.0 - Unauthenticated SQL Injection
Medium
CVE-2025-66125
Ultimate Auction <= 4.3.3 - Unauthenticated Information Exposure
Medium
f33bcc8d-3d21-4de8-87ac-a5e334bb641d
WPGraphQL Smart Cache < 2.0.1 - Unauthenticated Private Content Disclosure
Medium
CVE-2025-8780
Livemesh SiteOrigin Widgets <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table Widgets
Medium
CVE-2025-9488
Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
Medium
CVE-2025-8195
JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets
High
CVE-2025-14072
Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure
Medium
CVE-2025-14056
Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter
Medium
CVE-2025-66068
InstaWP Connect <= 0.1.1.9 - Missing Authorization
Critical
CVE-2025-66074
Webhooks <= 3.3.8 - Unauthenticated Arbitrary File Upload
High
CVE-2025-67524
Jobmonster Elementor Addon <= 1.1.4 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-24569
PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Unauthenticated Path Traversal
Medium
CVE-2025-7960
King Addons for Elementor <= 51.1.53 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-64243
Directory Pro <= 2.5.6 - Missing Authorization
Medium
CVE-2025-13153
Logo Slider <= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-68084
Ultimate Auction <= 4.3.2 - Missing Authorization
Medium
CVE-2025-64242
Easy Property Listings <= 3.5.22 - Missing Authorization
High
CVE-2025-67522
Jobmonster <= 4.8.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-66126
Fix Media Library <= 2.0 - Unauthenticated Information Exposure
Medium
CVE-2025-13456
Shopbuilder <= 3.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-12685
WPBookit <= 1.0.7 - Cross-Site Request Forgery to Customer Deletion
Medium
CVE-2025-67466
Trinity Audio <= 5.23.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.