High
CVE-2025-53428
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2025-53425
Dokan <= 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation
Medium
CVE-2025-53426
Likert Survey Master <= 0.8.0.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-53427
SEO Pyramid <= 1.10.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-9882
osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-9887
Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-9883
Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-10002
ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection
Medium
CVE-2025-10652
Robcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode
High
CVE-2025-7665
Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-9949
Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
Medium
CVE-2025-10720
WP Private Content Plus <= 3.6.2 - Unauthenticated Information Exposure
Medium
CVE-2025-10305
Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion
Medium
CVE-2025-10124
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.14 - Authenticated (Contributor+) Booking Deletion
Medium
CVE-2025-53424
WooCommerce Orders & Customers Exporter <= 5.4 - Missing Authorization
Medium
CVE-2025-53423
Triss <= 2.6 - Reflected Cross-Site Scripting
Medium
CVE-2025-58916
Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-10489
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
Medium
CVE-2025-10658
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
Medium
CVE-2025-10181
Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-10647
Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2025-5948
Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business
Medium
CVE-2025-10146
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
High
CVE-2025-5955
Service Finder SMS System <= 2.0.0 - Authentication Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.