Medium
CVE-2025-58978
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-8388
PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'
Medium
CVE-2025-58989
Dynamic Text Field For Contact Form 7 <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58977
WP eBay Product Feeds <= 3.4.8 - Authenticated (Contributor+) Server Side Request Forgery
Medium
CVE-2025-58983
Include Me <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-58979
BerqWP <= 2.2.53 - Missing Authorization
Medium
CVE-2025-58985
Additional Custom Product Tabs for WooCommerce <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58976
Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization
Critical
CVE-2025-10690
Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
High
CVE-2025-9539
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation
Medium
CVE-2025-9542
AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
Medium
CVE-2025-9061
Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-9058
Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-9489
WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
Critical
CVE-2025-9114
Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change
Critical
CVE-2025-9113
Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload
High
CVE-2025-9112
Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-59004
WC Return products <= 1.5 - Reflected Cross-Site Scripting
Medium
CVE-2024-5200
Postie <= 1.9.70 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-59005
Categorify <= 1.0.7.5 - Missing Authorization
Medium
CVE-2025-59008
ZIP Code Based Content Protection <= 1.0.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-59006
Easy Woocommerce Customizer <= 1.0.2 - Reflected Cross-Site Scripting
High
CVE-2025-60213
Scape <= 1.5.13 - Unauthenticated PHP Object Injection
High
CVE-2025-53238
Toast Mobile Menu <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.