Medium
CVE-2025-11166
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Critical
CVE-2025-10586
Community Events <= 1.5.1 - Unauthenticated SQL Injection
Medium
CVE-2025-62935
Open Close WooCommerce Store <= 5.0.1 - Missing Authorization
Medium
CVE-2025-9371
Betheme <= 28.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'page_title'
Critical
CVE-2025-11522
Search & Go - Directory WordPress Theme <= 2.7 - Authentication Bypass to Privilege Escalation via Account Takeover
Medium
CVE-2025-62936
xSmart <= 1.2.9.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Medium
CVE-2025-59001
Salient Core <= 3.0.8 - Missing Authorization
Medium
CVE-2025-48092
Fix Multiple Redirects <= 1.2.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-48097
WSAnalytics <= 1.1.2 - Reflected Cross-Site Scripting
High
CVE-2025-58953
Joly <= 1.22.0 - Unauthenticated Local File Inclusion
High
CVE-2025-10862
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'
Medium
CVE-2025-48096
Custom CSS <= 1.4.0 - Missing Authorization
Medium
CVE-2025-48091
AnyComment <= 0.3.6 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-10249
Slider Revolution <= 6.7.37 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Read
Medium
CVE-2025-60246
Simple Finance Calculator <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-28080
Rank Math SEO PRO <= 3.0.96 - Missing Authorization
Medium
CVE-2025-48093
Password only login <= 0.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-9544
Doppler Forms = 2.5.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
Medium
CVE-2025-11171
Chartify – WordPress Chart Plugin <= 3.5.9 - Missing Authentication for Administrative Function
High
CVE-2025-11204
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.6.2 - Authenticated (Administrator+) SQL Injection
High
CVE-2025-10494
Motors – Car Dealership & Classified Listings Plugin <= 1.4.89 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2025-10587
Community Events <= 1.5.1 - Unauthenticated SQL Injection
Medium
CVE-2025-62933
Awesome Testimonials <= 2.2.1 - Cross-Site Request Forgery
High
CVE-2025-59550
Xcare < 6.5 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.