Medium
CVE-2025-6221
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-7649
Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7684
Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-7683
LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-7664
Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function
Medium
CVE-2025-7686
weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Critical
CVE-2025-7441
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-8898
Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2025-8143
Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'
High
CVE-2025-49915
SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection
Medium
CVE-2024-8393
Woocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion
High
CVE-2025-60062
tPlayer <= 1.2.1.6 - Unauthenticated SQL Injection
Medium
CVE-2025-49897
Vertical scroll slideshow gallery v2 <= 9.1 - Authenticated (Contributor+) SQL Injection
High
CVE-2025-8105
Soledad <= 8.6.7 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-49432
Ultimate Video Player <= 10.1 - Missing Authorization
Medium
95550fd3-13e5-4341-8551-efe9070b0ada
WP Discord Post Plus - Supports Unlimited Channels <= 1.0.2 - Cross-Site Request Forgery
Medium
CVE-2025-8878
Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.4 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-49896
School Management <= 93.1.0 - Unauthenticated Insecure Direct Object Reference
High
CVE-2025-8142
Soledad <= 8.6.7 - Authenticated (Contributor+) Local File Inclusion via 'header_layout'
Medium
CVE-2025-52748
Directory Pro <= 2.5.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-8944
OceanWP <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2024-12575
Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure
Medium
CVE-2025-49898
Dropshix <= 4.0.14 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2025-60087
Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.