Medium
CVE-2025-13140
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-12483
Visualizer: Tables and Charts Manager for WordPress <= 3.11.12 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-13007
WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets (Google Reviews, YouTube Feed, Photo Feeds, and More) <= 3.20.3 - Unauthenticated Stored Cross-Site Scripting via External Content Import
Medium
CVE-2025-13606
Export All Posts, Products, Orders, Refunds & Users <= 2.19 - Cross-Site Request Forgery to Sensitive Information Exposure
High
CVE-2025-13387
Kadence WooCommerce Email Designer <= 1.5.17 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-13697
BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library <= 2.2.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via `timestamp` Attribute
High
CVE-2025-12529
Cost Calculator Builder <= 3.6.3 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2025-49041
Get Cash <= 3.2.3 - Missing Authorization
Medium
CVE-2025-13835
Arconix Shortcodes <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13731
Nexter Extension <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-10019
Contact Form Email <= 1.3.60 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-13534
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.2 - Authenticated (Contributor+) Privilege Escalation via eh_crm_edit_agent AJAX Action
Medium
CVE-2025-66054
LearnPress <= 4.2.9.4 - Missing Authorization
Medium
CVE-2025-63054
Quiz And Survey Master <= 10.3.2 - Missing Authorization
Medium
CVE-2025-66082
WpEvently <= 5.0.4 - Missing Authorization
Medium
CVE-2025-66120
CatFolders <= 2.5.3 - Missing Authorization
Medium
CVE-2025-63023
Payment Gateway for PayPal on WooCommerce <= 9.0.53 - Missing Authorization
Medium
CVE-2025-67625
Trade Runner <= 3.14 - Cross-Site Request Forgery
High
CVE-2025-63017
WerkStatt <= 1.6.6 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-66122
Stylish Price List <= 7.2.2 - Missing Authorization
Medium
CVE-2025-66109
Cart Weight for WooCommerce <= 1.9.11 - Missing Authorization
Medium
CVE-2025-64270
Masteriyo - LMS <= 2.0.3 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2025-63042
Tutor LMS Elementor Addons <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-66121
SiteGround Security <= 1.5.8 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.