Medium
CVE-2025-9367
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-10049
Responsive Filterable Portfolio <= 1.0.24 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2025-10142
PagBank / PagSeguro Connect para WooCommerce <= 4.44.3 - Authenticated (Shop Manager+) SQL Injection
Medium
CVE-2025-9463
Payments Plugin and Checkout Plugin for WooCommerce: Stripe, PayPal, Square, Authorize.net <= 1.117.5 - Authenticated (Contributor+) SQL Injection via order_by Parameter
Medium
CVE-2025-8778
NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function
High
CVE-2025-10040
WP Import – Ultimate CSV XML Importer for WordPress <= 7.27 - Missing Authorization to Authenticated (Subscriber+) FTP/SFTP Credential Exposure
Medium
CVE-2025-9622
WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing
Medium
CVE-2025-10126
MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9857
Heateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-7049
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
High
CVE-2025-7718
Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover
Medium
CVE-2025-7843
Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2025-7826
Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-6189
Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter
Medium
CVE-2025-9979
Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export
Medium
CVE-2025-9888
Maspik <= 2.5.6 - Cross-Site Request Forgery
Medium
CVE-2025-58988
My Tickets <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58991
WooCommerce Booking Bundle Hours <= 0.7.4 - Cross-Site Request Forgery
Medium
CVE-2025-58984
Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-58990
ShopLentor <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58997
Mow <= 4.10 - Cross-Site Request Forgery
Medium
CVE-2025-58987
Football Pool <= 2.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58980
Export WP Page to Static HTML/CSS <= 4.1.0 - Missing Authorization
Medium
CVE-2025-58982
Pixeline's Email Protector <= 1.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.