High
CVE-2025-12570
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-12655
Hippoo Mobile App for WooCommerce <= 1.7.1 - Missing Authorization to Unauthenticated Limited File Write
Medium
CVE-2025-14356
Ultra Addons for Contact Form 7 <= 3.5.33 - Missing Authorization to Authenticated (Subscriber+) to Generate Form Submission PDF
High
CVE-2025-13334
Blaze Demo Importer 1.0.0 - 1.0.13 - Missing Authorization to Authenticated (Subscriber+) Database Reset and File Deletion
Medium
CVE-2025-13866
Flow-Flow Social Feed Stream 3.0.0 - 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via flow_flow_social_auth AJAX action
Medium
CVE-2025-13975
Contact Form 7 with ChatWork <= 1.1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'api_token' and 'roomid' Settings
High
CVE-2025-12968
Infility Global <= 2.14.42 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-14032
Bold Timeline Lite <= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Parameter in 'bold_timeline_group' Shortcode
Medium
CVE-2025-14354
Resource Library for Logged In Users <= 1.5 - Cross-Site Request Forgery to Multiple Administrative Actions
Medium
CVE-2025-13989
WP Dropzone <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'callback' Shortcode Attribute
Medium
CVE-2025-14393
Wpik WordPress Basic Ajax Form <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13366
Rabbit Hole <= 1.1 - Cross-Site Request Forgery to Settings Reset
Medium
CVE-2025-13988
评论小秘书 <= 1.3.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-13320
WP User Manager <= 2.9.12 - Authenticated (Subscriber+) Arbitrary File Deletion via 'current_user_avatar' Parameter
Critical
CVE-2025-12963
LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart <= 1.7.43 - Missing Authorization to Uanuthenticated Privilege Escalation
Medium
CVE-2025-14392
Simple Theme Changer <= 1.0. - Missing Authorization to Plugin Settings Update via AJAX Actions
Medium
CVE-2025-14391
Simple Theme Changer <= 1.0 - Cross-Site Request Forgery to Arbitrary Theme Switcher Configuration Update
Critical
CVE-2025-14344
Multi Uploader for Gravity Forms <= 1.1.7 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2025-13363
IMAQ Core <= 1.2.1 - Cross-Site Request Forgery to URL Structure Update
Medium
CVE-2025-14467
WP Job Portal <= 2.5.2 - Authenticated (Editor+) Stored Cross-Site Scripting via Job Description Field
Medium
CVE-2025-13440
Premmerce Wishlist for WooCommerce <= 1.1.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wishlist Deletion
Medium
CVE-2025-13314
Product Filtering by Categories, Tags, Price Range for WooCommerce <= 1.1.6 - Missing Authorization to Unauthenticated Plugin Settings Modification
Medium
CVE-2025-13850
LS Google Map Router <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13963
FX Currency Converter <= 0.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.