High
CVE-2025-67522
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-66126
Fix Media Library <= 2.0 - Unauthenticated Information Exposure
Medium
CVE-2025-13456
Shopbuilder <= 3.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-12685
WPBookit <= 1.0.7 - Cross-Site Request Forgery to Customer Deletion
Medium
CVE-2025-67466
Trinity Audio <= 5.23.3 - Missing Authorization
Medium
CVE-2025-12965
Magical Posts Display <= 1.2.54 - Authenticated (Author+) Stored Cross-Site Scripting via Magical Posts Accordion Widget
Medium
CVE-2025-14065
Simple Bike Rental <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Booking Data Exposure
Medium
CVE-2025-12407
Events Manager – Calendar, Bookings, Tickets, and more! <= 7.2.2.2 - Cross-Site Request Forgery to Location Deletion
Medium
CVE-2025-12408
Events Manager <= 7.2.2.2 - Unauthenticated Information Exposure
Medium
CVE-2025-14030
AI Feeds <= 1.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'aife_post_meta' Shortcode
Medium
CVE-2025-14442
Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File
Medium
CVE-2025-14159
Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export
Medium
CVE-2025-12348
Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Action Scheduler Task Execution
Medium
CVE-2025-14074
PDF for Contact Form 7 + Drag and Drop Template Builder <= 6.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Duplication
Medium
CVE-2025-13993
MailerLite – Signup forms (official) <= 1.7.16 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-15527
WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure
Medium
CVE-2025-12960
Simple CSV Table <= 1.0.1 - Directory Traversal to Authenticated (Contributor+) Arbitrary File Read
Low
CVE-2025-10583
WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forgery
Medium
CVE-2025-14049
VikRentItems Flexible Rental Management System <= 1.2.0 - Reflected Cross-Site Scripting via 'delto' Parameter
High
CVE-2025-14169
FunnelKit – Funnel Builder for WooCommerce Checkout <= 3.13.1.5 - Unauthenticated SQL Injection
Medium
CVE-2025-13891
Image Gallery – Photo Grid & Video Gallery (Modula) <= 2.13.3 - Missing Authorization to Arbitrary Directory Listing
Medium
CVE-2025-11876
Mailgun Subscriptions <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-14068
WPNakama <= 0.6.3 - Unauthenticated SQL Injection via 'order_by' Parameter
Medium
CVE-2025-13660
Guest Support <= 1.2.3 - Unauthenticated User Email Disclosure in guest_support_handler AJAX Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.