Medium
CVE-2025-13629
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-13907
CSS3 Buttons <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13894
CSV Sumotto <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-12577
Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update
Medium
CVE-2025-12574
Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion
Medium
CVE-2025-12717
List Attachments Shortcode <= 0.4.1a - Authenticated (Author+) Stored Cross-Site Scripting via list-attachments Shortcode
Medium
CVE-2025-13666
Helloprint <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification
Medium
CVE-2025-12091
Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Medium
CVE-2025-13626
myLCO <= 0.8.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-13898
Ultra Skype Button <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'btn_id' Shortcode Attribute
Medium
CVE-2025-13899
TR Timthumb <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Critical
CVE-2025-12673
Flex QR Code Generator <= 1.2.7 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-13857
Yet Another WebClap for WordPress <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13922
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause
Medium
CVE-2025-12505
weDocs <= 2.1.14 - Missing Authorization to Settings Update
High
CVE-2025-12510
Widgets for Google Reviews <= 13.2.4 - Unauthenticated Stored Cross-Site Scripting via Google Reviews
Medium
CVE-2025-11263
Link Whisper Free <= 0.8.8 - Reflected Cross-Site Scripting
Critical
CVE-2024-54229
SV100 Companion <= 2.0.02 - Unauthenticated Privilege Escalation
Medium
CVE-2025-67948
SendPulse Email Marketing Newsletter <= 2.2.1 - Authenticated (Subscriber+) Information Exposure
High
CVE-2025-63076
The7 Elements < 2.7.12 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-66066
Envo Extra <= 1.9.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-66526
Tablesome <= 1.1.34 - Missing Authorization
Medium
CVE-2025-62996
Custom Layouts – Post + Product grids made easy <= 1.4.12 - Missing Authorization
Medium
CVE-2025-63055
Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.