Medium
CVE-2025-10181
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-10647
Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2025-5948
Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business
Medium
CVE-2025-10146
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
High
CVE-2025-5955
Service Finder SMS System <= 2.0.0 - Authentication Bypass
Medium
CVE-2025-8487
Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
Medium
CVE-2025-53422
WhatsApp Chat for WordPress and WooCommerce <= 1.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-49938
JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9992
Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-8565
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation
High
CVE-2025-58995
Leblix <= 2.4 - Unauthenticated Local File Inclusion
Medium
CVE-2025-58918
Entrada <= 5.7.7 - Cross-Site Request Forgery
Medium
CVE-2025-10635
Find Me On <= 2.0.9.1 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2025-58963
Medcity < 1.1.9 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-58917
Quantities and Units for WooCommerce <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10493
Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
Medium
CVE-2025-64352
Essential Addons for Elementor <= 6.2.4 - Missing Authorization
Medium
CVE-2025-9203
Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields
Medium
CVE-2025-9565
Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
High
CVE-2025-10057
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
High
CVE-2025-10058
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-10125
Memberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9891
User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation
Medium
CVE-2025-10166
Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.