Medium
CVE-2025-8317
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-4588
360 Photo Spheres <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6754
SEO Metrics <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-8152
WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update
Medium
CVE-2025-8146
Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget
Medium
CVE-2025-6722
BitFire <= 4.5 - Unauthenticated Information Exposure
Medium
CVE-2025-6626
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL
Medium
CVE-2025-8281
WP Talroo <= 2.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-7694
Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2025-49386
Preserve Code Formatting <= 4.0.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-4684
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets
Medium
CVE-2025-6228
Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets
Medium
CVE-2025-7646
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7845
Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets
Medium
CVE-2025-4523
IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function
High
CVE-2025-7725
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-7443
BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-5947
Service Finder Bookings <= 6.0 - Authentication Bypass via User Switch Cookie
Critical
CVE-2025-5954
Service Finder SMS System <= 2.0.0 - Unauthenticated Privilege Escalation
Medium
CVE-2025-54685
SureDash <= 1.1.0 - Authenticated (Subscriber+) Information Disclosure
High
CVE-2025-52737
Store Locator <= 2.2.260 - Authenticated (Contributor+) PHP Object Injection
Critical
CVE-2025-48158
BuddyPress XProfile Custom Image Field <= 3.0.1 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-52732
Google Map Targeting <= 1.1.6 - Authenticated (Subscriber+) Local File Inclusion
Critical
CVE-2025-48148
StoreKeeper for WooCommerce <= 14.4.4 - Unauthenticated Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.