Medium
CVE-2025-11980
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-11448
Gallery Plugin for WordPress – Envira Photo Gallery <= 1.11.0 - Missing Authorization to Authenticated (Contributor+) Gallery Conversion
Medium
CVE-2025-12092
CYAN Backup <= 2.5.4 - Authenticated (Admin+) Arbitrary File Deletion
Medium
CVE-2025-12837
aThemes Addons for Elementor <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Call To Action Widget
Medium
CVE-2025-12643
Saphali LiqPay for donate <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-7663
Ovatheme Events Manager <= 1.8.6 - Missing Authorization
Medium
CVE-2025-12193
Mang Board WP <= 2.3.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-12000
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
Medium
CVE-2025-12353
WPFunnels <= 3.6.2 - Unauthorized User Registration
Medium
CVE-2025-12112
Insert Headers and Footers Code – HT Script <= 1.1.6 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-12583
Simple Downloads List <= 1.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2025-11452
Asgaros Forum <= 3.1.0 - Unauthenticated SQL Injection
Medium
CVE-2025-12125
HTML Forms <= 1.5.5 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-12098
Academy LMS Pro <= 3.3.8 - Unauthenticated Sensitive Information Exposure via 'enqueue_social_login_script'
Medium
CVE-2025-12498
EventPrime – Events Calendar, Bookings and Tickets <= 4.2.0.0 - Missing Authorization to Authenticated (Subscriber+) Booking Note Creation
Medium
CVE-2025-11748
Groups <= 3.7.0 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Group Join
Medium
CVE-2025-64371
Traveler < 3.2.6 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-12161
Smart Auto Upload Images <= 1.2.0 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-12621
Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update
Medium
CVE-2025-11972
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.0 - Authenticated (Editor+) SQL Injection
High
CVE-2025-49918
VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Unauthenticated Information Exposure
Medium
CVE-2025-64372
Traveler < 3.2.6 - Reflected Cross-Site Scripting
Medium
CVE-2025-63028
Traveler <= 3.2.6 - Missing Authorization
Medium
CVE-2025-12042
Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.