Medium
CVE-2025-11254
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-11518
WPC Smart Wishlist for WooCommerce <= 5.0.3 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Medium
CVE-2025-9196
Trinity Audio <= 5.21.0 - Unauthenticated Information Exposure
Medium
CVE-2025-10185
NEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.6 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-11197
Draft List <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9560
Colibri Page Builder <= 1.0.334 - Authenticated (Contributor+) Stored Cross-Site Scripting via colibri_newsletter Shortcode
Medium
CVE-2025-62947
Publitio <= 2.2.3 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-62939
Open Currency Converter <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49936
WoodMart < 8.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
CVE-2025-8606
GSheetConnector For Gravity Forms <= 1.3.23 - Cross-Site Request Forgery to Arbitrary Plugin Activation/Deactivation
Medium
CVE-2025-11191
RealPress <= 1.0.9 - Missing Authorization to Unauthenticated Page Creation and Email Sending
High
CVE-2025-60039
Noisa <= 2.6.0 - Unauthenticated PHP Object Injection
High
CVE-2025-58954
HomeRoofer <= 2.11.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-11167
CM Registration – Tailored tool for seamless login and invitation-based registrations <= 2.5.6 - Open Redirect
Medium
CVE-2025-53232
WP Gmail SMTP <= 1.0.7 - Sensitive Information Exposure
Medium
CVE-2025-62944
MSTW CSV EXPORTER <= 1.4 - Missing Authorization
Medium
CVE-2025-62945
Did Prestashop Display <= 1.0.30 - Cross-Site Request Forgery
Medium
CVE-2025-8682
Newsup <= 5.0.10 - Missing Authorization to Authenticated (Subscriber+) Plugin Installation
Medium
CVE-2025-62940
Blox Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10048
My Auctions Allegro Plugin <= 3.6.31 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-11380
Everest Backup <= 2.3.5 - Missing Authorization to Unauthenticated Information Exposure
Critical
CVE-2025-6553
Ovatheme Events Manager <= 1.8.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-62941
Events Maker by dFactory <= 1.6.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62942
WP Mapbox GL JS Maps <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.