Medium
CVE-2025-60151
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-60171
Conditional Cart Messages for WooCommerce – YourPlugins.com <= 1.2.10 - Cross-Site Request Forgery
Medium
CVE-2025-64633
Norebro Extra <= 1.6.8 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-60135
WeShare Buttons <= 13.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-68038
Icegram Express Pro <= 5.9.13 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2025-60099
Embed Any Document <= 2.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-60124
Simple Colorbox <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62897
WP Recipe Maker < 10.1.0 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-60129
Yext <= 1.1.3 - Missing Authorization
Medium
CVE-2025-60144
Lenix scss compiler <= 1.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-60122
HivePress Claim Listings <= 1.1.3 - Missing Authorization
Medium
CVE-2025-10136
TweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10180
Markdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10490
Zephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-10137
Snow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery
Medium
CVE-2025-9984
Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure
Medium
CVE-2025-10377
System Dashboard <= 2.8.20 - Cross-Site Request Forgery
Medium
CVE-2025-9044
Mapster WP Maps <= 1.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10745
Banhammer – Monitor Site Traffic, Block Bad Users and Bots <= 3.4.8 - Unauthenticated Protection Mechanism Bypass
Low
CVE-2025-10173
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.3 - Insufficient Authorization to Authenticated (Editor+) Settings Update
Medium
CVE-2025-10752
OAuth Single Sign On – SSO (OAuth Client) <= 6.26.12 - Cross-Site Request Forgery
Medium
CVE-2025-8906
Widgets for Tiktok Feed <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10178
CM Business Directory <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10036
Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.