Medium
CVE-2025-8999
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2025-58619
Falang multilanguage <= 1.3.65 - Unauthenticated PHP Object Injection
High
CVE-2025-9216
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-9851
Appointmind <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58920
Cerato <= 2.2.18 - Reflected Cross-Site Scripting
Medium
CVE-2025-10188
The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Cross-Site Request Forgery to Arbitrary Directory Deletion in /wp-content
Medium
CVE-2025-10042
Quiz Maker <= 6.7.0.56 - Unauthenticated SQL Injection
High
CVE-2025-10143
Catch Dark Mode <= 2.0 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-8394
Productive Style <= 1.1.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_productive_breadcrumb Shortcode
Medium
CVE-2025-53421
Accordion <= 2.3.14 - Missing Authorization
Medium
CVE-2025-9215
StoreEngine – Powerful WordPress eCommerce Plugin for Payments, Memberships, Affiliates, Sales & More <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Download
Medium
CVE-2025-9808
The Events Calendar <= 6.15.2 - Missing Authorization to Unauthenticated Password-Protected Information Disclosure
Medium
CVE-2025-64200
Email Template Customizer for WooCommerce <= 1.2.17 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Medium
CVE-2025-8446
Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
Medium
CVE-2025-62895
Atarim <= 4.2.1 - Unauthenticated Information Exposure
Medium
CVE-2025-9703
Ultimate Addons for Elementor Lite <= 2.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
High
CVE-2025-58967
Businext < 2.4.4 - Unauthenticated Local File Inclusion
High
CVE-2025-9710
Responsive Lightbox & Gallery <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-53420
WPLMS <= 1.9.9.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-49925
WPLMS <= 1.9.9.7 - Missing Authorization
Medium
CVE-2025-53352
Grid Plus <= 3.3 - Reflected Cross-Site Scripting
High
CVE-2025-10176
The Hack Repair Guy's Plugin Archiver <= 2.0.4 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2025-53351
Fidelo Snippet <= 1.12 - Reflected Cross-Site Scripting
Medium
CVE-2025-64378
ListingPro < 2.9.10 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.