Medium
CVE-2025-12358
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Critical
CVE-2025-13486
Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form
Medium
CVE-2025-10304
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.3.8 - Missing Authorization to Unauthenticated Backup Failure
Medium
CVE-2025-13495
FluentCart A New Era of eCommerce <= 1.3.1 - Authenticated (Administrator+) SQL Injection via 'groupKey' Parameter
Medium
CVE-2025-12585
MxChat – AI Chatbot for WordPress <= 2.5.5 - Unauthenticated Information Exposure
Medium
CVE-2025-13448
CSSIgniter Shortcodes <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'element' Shortcode Attribute
High
CVE-2025-13646
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Upload via Race Condition
High
CVE-2025-13645
Modula 2.13.1 - 2.13.2 - Authenticated (Author+) Arbitrary File Deletion
Critical
CVE-2025-13542
DesignThemes LMS <= 1.0.4 - Unauthenticated Privilege Escalation
Medium
CVE-2025-66110
Tiktok Feed <= 1.0.23 - Missing Authorization
Medium
CVE-2025-67595
Quiz Maker <= 6.7.0.82 - Cross-Site Request Forgery
Medium
CVE-2025-59133
Projectopia <= 5.1.22 - Authenticated (Custom+) Insecure Direct Object Reference
Medium
CVE-2025-64238
WPS Bidouille <= 1.33.1 - Missing Authorization
Medium
CVE-2025-13090
WP Directory Kit <= 1.4.6 - Authenticated (Admin+) SQL Injection
High
CVE-2025-13516
SureMail – SMTP and Email Logs Plugin with Amazon SES, Postmark, and Other Providers <= 1.9.0 - Unauthenticated Arbitrary File Upload
High
CVE-2025-13724
VikRentCar Car Rental Management System <= 1.4.4 - Authenticated (Author+) SQL Injection via 'month' Parameter
Medium
CVE-2025-11726
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Global Preset Modification
Medium
CVE-2025-13696
Zigaform <= 7.6.5 - Unauthenticated Form Submission Data Disclosure in rocket_front_payment_seesummary AJAX Endpoint
Medium
CVE-2025-13685
Photo Gallery by Ays <= 6.4.8 - Cross-Site Request Forgery to Bulk Actions
Medium
CVE-2025-13140
SurveyJS: Drag & Drop WordPress Form Builder <= 1.12.20 - Cross-Site Request Forgery to Survey Deletion
Medium
CVE-2025-12483
Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-13007
WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import
Medium
CVE-2025-13606
Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
High
CVE-2025-13387
Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.