Medium
CVE-2025-31007
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2025-6184
Tutor LMS Pro – eLearning and online course solution <= 3.7.0 - Authenticated (Tutor Instructor+) SQL Injection
Medium
CVE-2025-8491
Easy restaurant menu manager <= 2.0.2 - Cross-Site Request Forgery to Menu Upload
Critical
CVE-2025-31100
School Management <= 1.93.1 (02-07-2025) - Authenticated (Student+) Arbitrary File Upload
Medium
CVE-2025-0818
Multiple elFinder Plugins <= (Various Versions) - Directory Traversal to Arbitrary File Deletion
Medium
CVE-2025-54692
Membership For WooCommerce <= 2.9.0 - Missing Authorization
Medium
CVE-2025-49057
WP Voting <= 1.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-54012
Welcart e-Commerce <= 2.11.16 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2025-49267
Frontend Admin by DynamiApps <= 3.28.3 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-8891
OceanWP <= 4.0.9 - 4.1.1 - Cross-Site Request Forgery to Ocean Extra Plugin Installation
Medium
CVE-2025-49058
SoundSt SEO Search <= 1.2.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-49038
WP Dynamic Links <= 1.0.1 - Reflected Cross-Site Scripting
Critical
CVE-2025-7384
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
Medium
CVE-2025-8874
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox
Medium
CVE-2025-8482
Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration
Medium
CVE-2025-8081
Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import
High
CVE-2025-6253
UiCore Elements <= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read
Medium
CVE-2025-8314
Software Issue Manager <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
Critical
CVE-2025-8059
B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function
Medium
CVE-2025-8621
Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter
Medium
CVE-2025-8690
Simple Responsive Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8688
Inline Stock Quotes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode
Medium
CVE-2025-8685
Wp chart generator <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode
Medium
CVE-2025-4390
WP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.