Medium
CVE-2025-58703
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-53467
Login-Logout <= 3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-58029
Classic Widgets with Block-based Widgets <= 1.0.1 - Missing Authorization
Medium
CVE-2025-60208
Advanced Custom Fields : CPT Options Pages <= 2.0.9 - Cross-Site Request Forgery
High
CVE-2025-64266
Booking and Rental Manager <= 2.5.4 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2025-53428
Simple User Registration <= 6.4 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2025-53425
Dokan <= 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation
Medium
CVE-2025-53426
Likert Survey Master <= 0.8.0.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-53427
SEO Pyramid <= 1.10.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-9882
osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-9887
Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-9883
Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-10002
ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection
Medium
CVE-2025-10652
Robcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode
High
CVE-2025-7665
Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-9949
Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
Medium
CVE-2025-10720
WP Private Content Plus <= 3.6.2 - Unauthenticated Information Exposure
Medium
CVE-2025-10305
Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion
Medium
CVE-2025-10124
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.14 - Authenticated (Contributor+) Booking Deletion
Medium
CVE-2025-53424
WooCommerce Orders & Customers Exporter <= 5.4 - Missing Authorization
Medium
CVE-2025-53423
Triss <= 2.6 - Reflected Cross-Site Scripting
Medium
CVE-2025-58916
Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-10489
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
Medium
CVE-2025-10658
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.