Medium
CVE-2025-12696
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2025-13526
OneClick Chat to Order <= 1.0.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-13318
Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
Medium
CVE-2025-13136
GSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure
Medium
CVE-2025-12877
IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Medium
CVE-2025-13317
Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter
High
CVE-2025-13384
CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
Medium
CVE-2025-12752
Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation
Medium
CVE-2025-11186
Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-11087
Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2025-10684
Construction Light <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
Medium
CVE-2025-67584
GoDAM <= 1.4.6 - Missing Authorization
Medium
CVE-2025-67598
SupportCandy <= 3.4.1 - Cross-Site Request Forgery
Medium
CVE-2025-14314
PopupKit <= 2.1.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-67474
ForumWP <= 2.1.4 - Missing Authorization
Medium
CVE-2025-66077
Legal Pages <= 1.4.6 - Missing Authorization
Medium
CVE-2025-9116
WPS Visitor Counter <= 1.4.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-67929
TI WooCommerce Wishlist <= 2.10.0 - Missing Authorization
Medium
CVE-2025-66064
Giveaways and Contests by RafflePress <= 1.12.20 - Cross-Site Request Forgery
Medium
CVE-2025-12964
Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget
Medium
CVE-2025-12750
Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-12066
WP Delete Post Copies <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-13138
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
Medium
CVE-2025-12039
BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.