Medium
CVE-2025-48159
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-54056
Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-52788
CaptionPix <= 1.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-8009
Security Ninja – Secure Firewall & Secure Malware Scanner - 5.201 - 5.242 - Authenticated (Administrator+) Arbitrary File Read
Critical
CVE-2025-8047
Multiple Plugins by itayamar - Backdoored Software
High
CVE-2025-49924
Wholesale Suite <= 2.2.4.2 - Authenticated (Shop Manager+) Privilege Escalation
Medium
CVE-2025-48162
Simple Business Directory Pro <= 15.5.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-47689
Video Blogster Lite <= 1.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-4968
WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements
High
CVE-2025-25172
VidMov <= 1.9.4 - Unauthenticated Local File Inclusion
Medium
CVE-2025-54027
Support Board <= 3.8.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-5818
Featured Image Plus – Quick & Bulk Edit with Unsplash <= 1.6.6 - Authenticated (Admin+) Server-Side Request Forgery
High
CVE-2025-7722
Social Streams <= 1.2.1 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2025-6190
Realty Portal – Agent <= 0.3.9 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via rp_user_profile() Function
Medium
CVE-2025-6054
YANewsflash <= 1.0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-6214
Omnishop <= 1.0.9 - Cross-Site Request Forgery to Arbitrary User Deletion via /users/delete REST Endpoint
Medium
CVE-2025-6215
Omnishop <= 1.0.9 - Missing Registration Restriction to Unauthenticated Account Creation via /users/register REST Endpoint
Medium
CVE-2025-5753
Valuation Calculator <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via link Parameter
Medium
CVE-2025-6261
Fleetwire Fleet Management Plugin <= 1.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via fleetwire_list Shortcode
Medium
CVE-2025-52712
Post and Page Builder by BoldGrid – Visual Drag and Drop Editor <= 1.27.8 - Authenticated (Contributor+) Path Traversal
High
CVE-2025-53213
ReachShip WooCommerce Multi-Carrier & Conditional Shipping <= 4.3.1 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-46255
LoginWP - Pro <= 4.0.8.5 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2025-3703
CSS & JavaScript Toolbox < 12.0.3 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2025-30998
WP Links Page <= 4.9.6 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.