Medium
CVE-2025-9946
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-8608
Mihdan: Elementor Yandex Maps <= 1.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Marker Pins
Medium
CVE-2025-10130
Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9852
Yoga Schedule Momoyoga <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-9993
Bei Fen – WordPress Backup Plugin <= 1.4.2 - Authenticated (Subscriber+) Local File Inclusion
Critical
CVE-2025-9762
Post By Email <= 1.0.4b - Unauthenticated Arbitrary File Upload via Email Attachments
Medium
CVE-2025-8559
All in One Music Player <= 1.3.1 - Authenticated (Contributor+) Path Traversal via theme Parameter
Medium
CVE-2025-8777
planetcalc <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via language Parameter
Medium
CVE-2025-10189
BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8566
GutenBee – Gutenberg Blocks <= 2.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10128
Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10168
Any News Ticker <= 3.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-9991
Tiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion
Critical
CVE-2025-8625
Copypress Rest API 1.1 - 1.2 - Missing Configurable JWT Secret and File-Type Validation to Unauthenticated Remote Code Execution
Medium
CVE-2025-8624
Nexa Blocks <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps Widget
Medium
CVE-2025-8214
The Pack Elementor addon <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typing Letter Widget
Medium
CVE-2025-10196
SurveyAnyplace Plugin <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8560
FancyTabs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter
Medium
CVE-2025-8623
WeedMaps Menu for WordPress <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via weedmaps_menu Shortcode
Medium
CVE-2025-10182
dbview <= 0.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10000
Qyrr – simply and modern QR-Code creation <= 2.0.7 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-10179
My AskAI <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9948
Chat by Chatwee <= 2.1.3 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-10191
Big Post Shipping for WooCommerce <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.