Medium
CVE-2025-12587
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-13404
atec Duplicate Page & Post <= 1.2.20 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication and Data Exposure
High
CVE-2025-13068
Telegram Bot & Channel <= 4.1 - Unauthenticated Stored Cross-Site Scripting via Telegram Username
Critical
CVE-2025-13559
EduKart Pro <= 1.0.3 - Unauthenticated Privilege Escalation
Medium
CVE-2025-13558
Blog2Social <= 8.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Trashing
Medium
CVE-2025-10646
Search Exclude <= 2.5.7 – Missing Authorization to Authenticated (Contributor+) Search Settings Modification via REST API
Critical
CVE-2025-6389
Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback
Medium
CVE-2025-10144
Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-64260
ANAC XML Bandi di Gara <= 7.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-12684
URL Shortify <= 1.11.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-11363
Royal Elementor Addons and Templates <= 1.7.1036 - Missing Authorization to Unauthenticated Media File Upload
Medium
CVE-2025-66087
PropertyHive <= 2.1.12 - Missing Authorization
Medium
CVE-2025-66088
PropertyHive <= 2.1.12 - Missing Authorization
Medium
CVE-2025-13355
URL Shortify <= 1.11.3 - Reflected Cross-Site Scripting
High
CVE-2025-7402
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.95 - Unauthenticated SQL Injection via site_id
Medium
CVE-2025-12800
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2025-66092
Accordion Slider <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-67517
ArtPlacer Widget <= 2.22.9.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-49335
External Media <= 1.0.36 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2025-66093
Extensions for Leaflet Map <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-24938
Better Search <= 4.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-24939
Modula Image Gallery <= 2.13.6 - Missing Authorization
Medium
CVE-2025-64268
Timetics <= 1.0.44 - Missing Authorization
Medium
CVE-2025-66071
Custom Order Numbers for WooCommerce <= 1.11.0 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.