High
CVE-2025-49890
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-49434
Laposta WooCommerce <= 1.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49889
Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49436
Custom Menu <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49438
Simple Login Log <= 1.1.3 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-64230
Filr <= 1.2.10 - Authenticated (Contributor+) Arbitrary File Deletion
Medium
CVE-2025-52751
Slide Puzzle <= 1.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-49891
Contact Info Widget <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49892
Pending Order Bot <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2025-49895
ServerBuddy by PluginBuddy.com <= 1.0.5 - Cross-Site Request Forgery to PHP Object Injection
Medium
CVE-2025-49894
WP Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-15659
Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49893
Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-15658
Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-52750
Emu2 <= 0.83b - Reflected Cross-Site Scripting
Medium
CVE-2025-8719
Translate This - Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter
Medium
CVE-2025-7499
BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure
Medium
CVE-2025-8464
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie
Medium
CVE-2025-8089
Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8896
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2024-12612
School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection
High
CVE-2025-6079
School Management System <= 93.2.0 - Authenticated (Student+) Arbitrary File Upload
High
CVE-2025-3671
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update
High
CVE-2025-6080
WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.