Medium
CVE-2025-11893
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-10488
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.4.8 - Authenticated (Subscriber+) Arbitrary File Move
Medium
CVE-2025-6639
Tutor LMS Pro – eLearning and online course solution <= 3.8.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to View/Edit Other Assignments
Medium
CVE-2025-11269
Product Filter by WBW <= 3.0.0 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-6680
Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-8413
Listeo <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via soundcloud Shortcode
Medium
CVE-2025-8666
Testimonial Carousel For Elementor <= 11.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-8588
Gutenberg Blocks – PublishPress Blocks Controls, Visibility, Reusable Blocks <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10694
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure
Low
CVE-2025-11244
Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing
High
CVE-2025-11238
Watu Quiz <= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer
Medium
CVE-2025-11564
Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
Medium
CVE-2025-12005
WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update
Medium
CVE-2025-11823
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-10579
BackWPup 5 - 5.5.0 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-11760
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-11875
SpendeOnline.org <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11897
The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
High
CVE-2025-8416
Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection
Medium
CVE-2025-62988
Slider Templates <= 1.0.3 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2025-4203
wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
Medium
CVE-2025-49907
MDTF <= 1.3.3.9 - Missing Authorization
Medium
CVE-2025-62100
ThemeRain Core <= 1.1.9 - Missing Authorization
Medium
CVE-2025-8483
Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.