Medium
CVE-2025-8487
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-53422
WhatsApp Chat for WordPress and WooCommerce <= 1.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-49938
JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9992
Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-8565
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation
High
CVE-2025-58995
Leblix <= 2.4 - Unauthenticated Local File Inclusion
Medium
CVE-2025-58918
Entrada <= 5.7.7 - Cross-Site Request Forgery
Medium
CVE-2025-10635
Find Me On <= 2.0.9.1 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2025-58963
Medcity < 1.1.9 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-58917
Quantities and Units for WooCommerce <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10493
Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
Medium
CVE-2025-64352
Essential Addons for Elementor <= 6.2.4 - Missing Authorization
Medium
CVE-2025-9203
Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields
Medium
CVE-2025-9565
Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
High
CVE-2025-10057
WP Import – Ultimate CSV XML Importer for WordPress 7.20 - 7.28 - Authenticated (Subscriber+) Remote Code Execution via Code Injection
High
CVE-2025-10058
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-10125
Memberlite Shortcodes <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9891
User Sync – Remote User Sync <= 1.0.2 - Cross-Site Request Forgery to Plugin Deactivation
Medium
CVE-2025-10166
Social Media Shortcodes <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-10162
Admin and Customer Messages After Order for WooCommerce: OrderConvo <= 13.5 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-9629
USS Upyun <= 1.5.0 - Cross-Site Request Forgery
Medium
CVE-2025-10050
Developer Loggers for Simple History <= 0.5 - Authenticated (Admin+) Local File Inclusion
Medium
CVE-2025-58921
Tactical Popup <= 1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-58919
Wide Banner <= 1.0.4 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.