Medium
CVE-2025-12191
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-12128
Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-13006
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure
Medium
CVE-2025-12417
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-13494
SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure
Critical
CVE-2025-13313
CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint
Medium
CVE-2025-13312
CRM Memberships <= 2.6 - Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action
Medium
CVE-2025-13362
Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update
High
CVE-2025-13066
Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
Medium
CVE-2025-11759
Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()
Medium
CVE-2025-12804
Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode
High
CVE-2025-13543
PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-63009
Google Analytics Events <= 2.8.2 - Unauthenticated Information Exposure
Medium
CVE-2025-63077
Happy Addons for Elementor <= 3.20.3 - Missing Authorization
Medium
CVE-2025-62733
Custom Sidebars by ProteusThemes <= 1.0.3 - Cross-Site Request Forgery
Medium
CVE-2025-62736
Image Cleanup <= 1.9.2 - Missing Authorization
Medium
CVE-2025-67570
WPForms Google Sheet Connector <= 4.0.0 - Missing Authorization
Medium
CVE-2025-67569
AdForest <= 6.0.11 - Missing Authorization
Medium
CVE-2025-62735
User Spam Remover <= 1.1 - Unauthenticated Information Exposure
Medium
CVE-2025-68494
Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure
Medium
CVE-2025-62762
SMTP Mail <= 1.3.49 - Cross-Site Request Forgery
Medium
CVE-2025-63008
ERP <= 1.16.7 - Missing Authorization
Medium
CVE-2025-62737
Image Cleanup <= 1.9.2 - Unauthenticated Information Exposure
Medium
CVE-2025-49348
Hype <= 1.0.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.