Medium
CVE-2025-63045
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-63035
WPLMS <= 1.9.9.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-63036
Ronneby Theme Core <= 1.5.68 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-64199
WpResidence <= 5.3.2 - Missing Authorization
Medium
CVE-2025-64361
Consulting Elementor Widgets <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64203
Mailster < 4.1.14 - Reflected Cross-Site Scripting
Medium
CVE-2025-62102
DoFollow Case by Case <= 3.5.1 - Cross-Site Request Forgery
Medium
CVE-2025-63052
SimpLy Gallery <= 3.3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-64198
Easy Social Share Buttons < 10.7.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-63071
Shortcodes and extra features for Phlox <= 2.17.13 - Unauthenticated Information Exposure
High
CVE-2025-62074
WPMobile.App <= 11.71 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2025-49372
HAPPY <= 1.0.7 - Unauthenticated Remote Code Execution
Medium
CVE-2025-64354
Gutenberg <= 21.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-66134
FileBird Pro <= 6.5.1 - Missing Authorization
Medium
CVE-2025-12034
Fast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-9322
Stripe Payment Forms <= 8.3.1 - Unauthenticated SQL Injection
Medium
CVE-2025-11976
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Cross-Site Request Forgery to Sync Rule Creation
Medium
CVE-2025-11255
Password Policy Manager | Password Manager <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Configuration Log Out
Medium
CVE-2025-10637
Social Feed Gallery <= 4.9.2 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-11893
Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More <= 1.8.8.4 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-10488
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
Medium
CVE-2025-6639
Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments
Medium
CVE-2025-11269
Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-6680
Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.