High
CVE-2025-49887
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-54748
MapSVG < 8.6.12 - Authenticated (Contributor+) Arbitrary File Download
High
CVE-2025-30633
Amazon Native Shopping Recommendations <= 1.3 - Unauthenticated SQL Injection
Medium
CVE-2025-52823
Cube Portfolio <= 1.16.8 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-7205
GiveWP – Donation Plugin and Fundraising Platform <= 4.5.0 - Authenticated (GiveWP worker+) Stored Cross-Site Scripting
Medium
CVE-2025-5720
Customer Reviews for WooCommerce <= 5.80.2 - Unauthenticated Stored Cross-Site Scripting via `author` Parameter
High
CVE-2025-7847
AI Engine 2.9.3 - 2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-54680
Blogger Buzz <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-54691
Motors <= 1.4.80 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-54687
JetTabs <= 2.2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-54672
Photo Engine <= 6.4.3 - Cross-Site Request Forgery
Medium
CVE-2025-54695
HT Mega <= 2.9.0 - Missing Authorization
Medium
CVE-2025-54703
Integrate Google Drive <= 1.5.2 - Cross-Site Request Forgery
Medium
CVE-2025-54683
WP Modal Popup with Cookie Integration <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-54694
Button Block <= 1.2.0 - Cross-Site Request Forgery
High
CVE-2025-58958
SmilePure < 1.8.5 - Unauthenticated Local File Inclusion
Medium
CVE-2025-54682
Connector for Gravity Forms and Google Sheets <= 1.2.4 - Cross-Site Request Forgery
Medium
CVE-2025-54675
YITH WooCommerce Popup <= 1.48.0 - Cross-Site Request Forgery
Medium
CVE-2025-8068
HT Mega – Absolute Addons For Elementor <= 2.9.1 - Improper Authorization to Authenticated (Contributor+) Limited Administrator Actions
Medium
CVE-2025-54688
JetEngine <= 3.7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-48149
Cook&Meal <= 1.2.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-54698
Classified Listing <= 5.0.0 - Authenticated (Contributor+) Content Injection
Medium
CVE-2025-54673
Chartify <= 3.5.3 - Cross-Site Request Forgery
Medium
CVE-2025-54704
Easy Elementor Addons <= 2.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.