Medium
CVE-2025-12093
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-12355
Payaza <= 0.3.8 - Missing Authorization to Unauthenticated Order Status Update
Medium
CVE-2025-13622
Jabbernotification <= 0.99-RC2 - Reflected Cross-Site Scripting via admin.php PATH_INFO
High
CVE-2013-6880
Time Sheets <= 2.1.3 - Use of Known Vulnerable Component
Medium
CVE-2025-10055
Time Sheets <= 2.1.3 - Cross-Site Request Forgery
Medium
CVE-2025-13623
Twitscription <= 0.1.1 - Reflected Cross-Site Scripting via admin.php PATH_INFO
Medium
CVE-2025-13625
WP-SOS-Donate Donation Sidebar Plugin <= 0.9.2 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-12124
FitVids for WordPress <= 4.0.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-13621
dream gallery <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via 'dreampluginsmain' AJAX Action
Medium
CVE-2025-12368
Sermon Manager <= 2.30.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-12181
ContentStudio <= 1.3.7 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2025-13144
ContentStudio <= 1.3.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12133
EPROLO Dropshipping <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Tracking Data Modification
Medium
CVE-2025-13860
Easy Jump Links Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2025-12153
Featured Image via URL <= 0.1 - Authenticated (Contributor+) Arbitrary FIle Upload
Medium
CVE-2025-12370
Takeads <= 1.0.13 - Missing Authorization to Plugin Settings Deletion
High
CVE-2025-12154
Auto Thumbnailer <= 1.0 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-12190
Image Optimizer by wps.sk <= 1.2.0 - Cross-Site Request Forgery to Bulk Image Optimization
Medium
CVE-2025-13512
CoSign Single Signon <= 0.3.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-12165
Webcake – Landing Page Builder <= 1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2025-12189
Bread & Butter: Gate content + Capture leads + Collect first-party data + Nurture with Ai agents <= 7.11.1374 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2025-12163
Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-13528
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
Medium
CVE-2025-13360
Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.