Medium
CVE-2025-13054
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-12349
Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger
Medium
CVE-2025-12426
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12770
New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling
Medium
CVE-2025-6251
Royal Elementor Addons and Templates <= 1.7.1036 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12777
YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion
Medium
CVE-2025-12427
YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Insecure Direct Object Reference to Unauthenticated Wishlist Rename
Medium
CVE-2025-12545
Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more <= 1.49.2 - Unauthenticated Information Exposure
Medium
CVE-2025-12376
Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-8084
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
Medium
CVE-2025-66070
wpForo Forum <= 2.4.10 - Missing Authorization
Medium
CVE-2025-13031
WPeMatico RSS Feed Fetcher <= 2.8.12 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-66102
FV Antispam <= 2.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-66101
CBX Bookmark & Favorite <= 2.0.1 - Missing Authorization
High
CVE-2025-13206
GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
High
CVE-2025-13070
CSV to SortTable <= 4.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-13071
Custom Admin Menu <= 1.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-12174
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
Medium
CVE-2025-68976
Eagle Booking <= 1.3.4.3 - Missing Authorization to Authenticated (Subscriber+) Settings Change
Medium
CVE-2025-68975
Eagle Booking <= 1.3.4.3 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2025-63026
Grand Restaurant Theme Elements for Elementor <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12710
Pet-Manager – Petfinder <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via kwm-petfinder Shortcode
Medium
CVE-2025-67587
Gravity Forms FreshDesk <= 1.3.5 - Unauthenticated Open Redirect
Medium
CVE-2026-23543
Essential Addons for Elementor <= 6.5.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.