Medium
CVE-2025-11162
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-11835
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal
Medium
CVE-2025-12580
SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-12582
Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset
Medium
CVE-2025-8871
Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
Medium
CVE-2025-64228
SUMO Affiliates Pro <= 11.0.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-64275
Booking Manager <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49913
CoSchedule <= 3.4.0 - Missing Authorization
Critical
CVE-2025-12674
KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-62106
WP-CRM System <= 3.4.5 - Missing Authorization
Medium
CVE-2025-49903
ZoloBlocks <= 2.3.11 - Missing Authorization
Medium
CVE-2025-64365
Ohio Extra <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12677
KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure
Medium
CVE-2025-64220
Rey Core <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12400
LMB^Box Smileys <= 3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-11733
Footnotes Made Easy <= 3.0.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11812
Reuse Builder <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12452
Visit Counter 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-11758
All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier <= 2.0.3 - Missing Authorization to Page Creation and Information Exposure
Medium
CVE-2025-11753
Multi-language Responsive Portfolio WordPress <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-12389
Import Export For WooCommerce <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
High
CVE-2025-11890
Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass
Medium
CVE-2025-12393
Free Quotation <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-10896
Multiple Plugins <= Multiple Versions - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.