Medium
CVE-2025-12010
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-12588
USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12644
Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
High
CVE-2025-11451
Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-12019
Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-11873
WP BBCode <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12754
Geopost <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12126
The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
Medium
CVE-2025-11999
Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-11860
Twitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11805
Skip to Timestamp <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11996
Find Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Medium
CVE-2025-12021
WP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-12753
Chart Expert <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11894
Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-11891
Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files
Medium
CVE-2025-12132
WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12662
Coon Google Maps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11886
CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
Medium
CVE-2025-12526
Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
High
CVE-2025-11521
Astra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-11869
Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12663
Jeba Cute forkit <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-11457
EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.