Medium
CVE-2025-12018
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-12113
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion
Medium
CVE-2025-12087
Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion
Medium
CVE-2025-12901
Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
Medium
CVE-2025-64217
Photography <= 7.7.2 - Reflected Cross-Site Scripting
High
CVE-2025-12835
WooMulti <= 1.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-13000
DB Access <= 0.8.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-66061
Seriously Simple Podcasting <= 3.13.0 - Cross-Site Request Forgery
Medium
CVE-2025-12833
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
Medium
CVE-2025-66099
Chat Help <= 3.1.3 - Missing Authorization
Medium
CVE-2025-13001
Donation <= 1.0 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-12788
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
Medium
CVE-2025-12953
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering
Critical
CVE-2025-12539
TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover
Medium
CVE-2025-12787
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
High
CVE-2025-12846
Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
An arbitrary file upload vulnerability in the Blocksy Companion plugin for WordPress allows authenticated attackers with author-level permissions or higher to upload arbitrary files, potentially leading to remote code execution.
Medium
CVE-2025-12880
Progress Bar Blocks for Gutenberg <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Medium
CVE-2025-12652
Ungapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11129
Include fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'api' and 'type'
Medium
CVE-2025-12672
Flickr Show <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11874
Slippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12671
WP-Iconics <= 0.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11829
Five9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12667
GitHub Gist Shortcode Plugin <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.