Medium
CVE-2025-12015
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-10295
Angel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-12620
Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` Parameter
Medium
CVE-2025-12891
Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-12366
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
Medium
CVE-2025-12536
SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12892
Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update
High
CVE-2025-11923
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation
High
CVE-2025-12844
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
Medium
CVE-2025-67559
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Missing Authorization
Medium
CVE-2025-67472
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Cross-Site Request Forgery
High
CVE-2025-12733
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
Medium
CVE-2025-64218
Passster <= 4.2.19 - Unauthenticated Information Exposure
Medium
CVE-2025-12954
Timetable and Event Schedule by MotoPress <= 2.4.15 - Insecure Direct Object Reference to Authenticated (Contributor+) Event Disclosure
Medium
CVE-2025-12377
Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions
Medium
CVE-2025-64293
0 Day Analytics <= 4.0.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-12681
Comment Edit Core – Simple Comment Editing <= 3.1.0 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12979
Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-12089
Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion
Medium
CVE-2025-11454
Specific Content For Mobile – Customize the mobile version without redirections <= 0.5.5 - Authenticated (Contributor+) SQL Injection
High
CVE-2025-11994
Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-12732
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
High
CVE-2025-12903
Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud
High
CVE-2025-12633
Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.