Medium
CVE-2025-12787
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,822
Reset filters
Medium
CVE-2025-12588
USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-11894
Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-11891
Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files
Medium
CVE-2025-11821
Woocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-49379
Custom Fields Account Registration For Woocommerce <= 1.2 - Authenticated (Author+) Privilege Escalation
Medium
CVE-2025-64267
WooCommerce Ultimate Points And Rewards <= 2.10.2 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-64222
WooCommerce Recover Abandoned Cart <= 24.6.0 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
High
CVE-2025-11967
Mail Mint <= 1.18.10 - Authenticated (Admin+) Arbitrary File Upload
Medium
CVE-2025-12000
WPFunnels <= 3.6.2 - Authenticated (Administrator+) Arbitrary File Deletion via Path Traversal
Medium
CVE-2025-12353
WPFunnels <= 3.6.2 - Unauthorized User Registration
Medium
CVE-2025-12621
Flexible Refund and Return Order for WooCommerce <= 1.0.42 - Incorrect Authorization to Authenticated (Contributor+) Refund Status Update
Medium
CVE-2025-12468
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12469
FunnelKit Automations – Email Marketing Automation and CRM for WordPress & WooCommerce <= 3.6.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending
Medium
CVE-2025-12389
Import Export For WooCommerce <= 1.6.2 - Missing Authorization to Authenticated (Subscriber+) Settings Update
High
CVE-2025-11890
Crypto Payment Gateway with Payeer for WooCommerce <= 1.0.3 - Unauthenticated Payment Bypass
Critical
CVE-2025-12493
ShopLentor <= 3.2.5 - Unauthenticated Local PHP File Inclusion via 'load_template'
High
CVE-2025-49904
Booking and Rental Manager <= 2.5.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-10897
WooCommerce Designer Pro <= 1.9.28 - Unauthenticated Arbitrary File Read
High
CVE-2025-12115
WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration
Medium
CVE-2025-64379
Booster for WooCommerce <= 7.4.0 - Missing Authorization
Critical
CVE-2025-8489
King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor 24.12.92 - 51.1.14 - Unauthenticated Privilege Escalation
Medium
CVE-2025-64358
Smart Coupons for WooCommerce <= 2.2.3 - Missing Authorization
Medium
CVE-2025-67599
WebToffee eCommerce Marketing Automation <= 2.1.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.