High
CVE-2025-10040
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-9622
WP Blast | SEO & Performance Booster <= 1.8.6 - Cross-Site Request Forgery to Cache Clearing
Medium
CVE-2025-10126
MyBrain Utilities <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9857
Heateor Login – Social Login Plugin <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-7049
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
High
CVE-2025-7718
Resideo Plugin for Resideo - Real Estate WordPress Theme <= 2.5.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Privilege Escalation via Account Takeover
Medium
CVE-2025-7843
Auto Save Remote Images (Drafts) <= 1.0.9 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2025-7826
Testimonial <= 2.3 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-6189
Duplicate Page and Post <= 2.9.5 - Authenticated (Contributor+) SQL Injection via meta_key Parameter
Medium
CVE-2025-9979
Maspik <= 2.5.6 - Authenticated (Subscriber+) Missing Authorization to Spam Log Export
Medium
CVE-2025-9888
Maspik <= 2.5.6 - Cross-Site Request Forgery
Medium
CVE-2025-58988
My Tickets <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58991
WooCommerce Booking Bundle Hours <= 0.7.4 - Cross-Site Request Forgery
Medium
CVE-2025-58984
Welcart e-Commerce <= 2.11.20 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-58990
ShopLentor <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58997
Mow <= 4.10 - Cross-Site Request Forgery
Medium
CVE-2025-58987
Football Pool <= 2.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58980
Export WP Page to Static HTML/CSS <= 4.1.0 - Missing Authorization
Medium
CVE-2025-58982
Pixeline's Email Protector <= 1.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-10001
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
Medium
CVE-2025-58993
Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-49398
Easy Appointments <= 3.12.14 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-58981
Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization
Medium
CVE-2025-58975
Advanced Settings <= 3.1.1 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.