Medium
CVE-2025-66058
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-62924
Post Grid and Gutenberg Blocks <= 2.3.17 - Missing Authorization
Medium
CVE-2025-10383
Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-9952
Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-10746
Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization
Medium
CVE-2025-11227
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure
Medium
CVE-2025-11228
GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association
Critical
CVE-2025-9485
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Authentication Bypass via get_resource_owner_from_id_token()
High
CVE-2025-9243
Cost Calculator Builder <= 3.5.32 - Authenticated (Subscriber+) Missing Authorization via get_cc_orders/update_order_status Functions
Medium
CVE-2025-9030
Majestic Before After Image <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9029
WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function
Medium
CVE-2025-8726
WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload
Medium
CVE-2025-9886
Trinity Audio <= 5.20.2 - Cross-Site Request Forgery
High
CVE-2025-62025
JobSearch < 3.0.8 - Unauthenticated PHP Object Injection
Medium
CVE-2025-49940
Fusion Builder <= 3.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64634
Avada <= 7.13.2 - Missing Authorization
Medium
CVE-2025-62917
Tooltipy <= 5.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10874
Orbit Fox by ThemeIsle <= 3.0.1 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2025-9978
Jeg Kit for Elementor – Powerful Elementor Addons, Widgets & Templates for WordPress < 2.6.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Medium
CVE-2025-9204
X Addons for Elementor <= 1.0.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Youtube Video ID Field
Critical
CVE-2025-10726
WPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion
Medium
CVE-2025-9199
Woo superb slideshow transition gallery with random effect <= 9.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-9206
Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9045
Easy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.