Medium
CVE-2025-62946
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-62943
Next Page, Not Next Post <= 0.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11814
Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-11533
WP Freeio <= 1.2.21 - Unauthenticated Privilege Escalation
Medium
CVE-2025-48088
Ultimate Addons for WPBakery Page Builder < 3.21.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9496
Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode
Medium
CVE-2025-53218
AppExperts <= 1.4.5 - Unauthenticated Sensitive Information Exposure
High
CVE-2025-48098
Survey Maker <= 5.1.8.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-62029
Grevo <= 2.4 - Unauthenticated Local File Inclusion
Medium
CVE-2025-62937
Post List Featured Image <= 0.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49937
Smash Balloon Social Post Feed <= 4.3.2 - Missing Authorization
High
CVE-2025-62031
tagDiv Composer <= 5.4.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-63065
Media Library Assistant <= 3.29 - Missing Authorization
Medium
CVE-2025-58595
WordPress All In One Login Plugin <= 2.0.8 - IP Sooofing to Protection Mechanism Bypass
Medium
CVE-2025-62938
Reoon Email Verifier <= 2.0.1 - Missing Authorization
Medium
CVE-2025-68079
Salient Shortcodes <= 1.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48095
Survey Maker <= 5.1.8.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-68078
Salient Portfolio <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7374
WP JobHunt <= 7.6 Authenticated (Custom+) Authorization Bypass
Medium
CVE-2025-7781
WP JobHunt <= 7.6 - Authenticated (Candidate+) Stored Cross-Site Scripting via ‘cs_job_title’
Critical
CVE-2025-7634
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Unauthenticated Local File Inclusion
Critical
CVE-2025-7526
WP Travel Engine – Tour Booking Plugin – Tour Operator Software <= 6.6.7 - Authenticated (Subscriber+) Arbitrary File Deletion via File Renaming
High
CVE-2025-6038
Lisfinity Core - Lisfinity Core plugin used for pebas® Lisfinity WordPress theme <= 1.4.0 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2025-10496
Cookie Notice & Consent <= 1.6.5 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.