Medium
CVE-2025-8942
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2025-5305
Password Reset with Code <= 0.0.16 - Unauthenticated Privilege Escalation via Weak OTP Codes
Medium
CVE-2025-8147
LWSCache <= 2.8.5 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation via lwscache_activatePlugin Function
Medium
CVE-2025-6255
Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Medium
CVE-2025-8073
Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter
Medium
CVE-2025-7956
Ajax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler
Critical
CVE-2025-7955
RingCentral Communications 1.5 - 1.6.8 - Missing Server‑Side Verification to Authentication Bypass via ringcentral_admin_login_2fa_verify Function
Medium
CVE-2024-9648
WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload
Medium
CVE-2025-9345
File Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download
Medium
CVE-2025-58197
Simple Download Monitor <= 3.9.34 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58210
Makeaholic <= 1.8.5 - Missing Authorization
High
CVE-2025-54716
Ireca <= 1.8.5 - Unauthenticated Local File Inclusion
High
CVE-2025-53251
Pin WP < 7.2 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-58209
Transcoder <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9346
Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-49383
Neresa <= 1.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-58195
Xpro Elementor Addons <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-60205
ThemeREX Addons <= 2.36.1.1 - Unauthenticated PHP Object Injection
High
CVE-2025-7812
Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection
Medium
CVE-2025-58208
PDF for Elementor Forms + Drag And Drop Template Builder <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58198
Xpro Theme Builder <= 1.2.9 - Missing Authorization
Medium
CVE-2025-58216
WP Thumbtack Review Slider <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2024-13807
Xagio SEO <= 7.1.0.5 - Unauthenticated Sensitive Information Exposure via Unprotected Back-Up Files
Medium
CVE-2025-58211
Chatbox Manager <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.