Critical
CVE-2025-60206
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-54030
WooCommerce Google Sheet Connector <= 1.3.20 - Cross-Site Request Forgery
Medium
CVE-2025-54047
Cost Calculator <= 7.4 - Missing Authorization
Medium
CVE-2025-54039
Animator <= 3.0.16 - Cross-Site Request Forgery
Medium
CVE-2025-53196
JetEngine <= 3.7.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-53988
JetBlocks For Elementor <= 1.3.18 - Authenticated (Subscriber+) Information Disclsoure
Medium
CVE-2025-50031
DB Backup <= 6.0 - Missing Authorization
Medium
CVE-2025-53992
JetTricks <= 1.5.4.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-48153
Import CDN-Remote Images <= 2.1.2 - Cross-Site Request Forgery
Medium
CVE-2025-54016
Videopack <= 4.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49928
JetWooBuilder <= 2.1.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-30635
IDonatePro <= 2.1.8 - Unauthenticated Local File Inclusion
High
CVE-2025-6993
Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function
Medium
CVE-2025-7035
Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes
High
CVE-2025-7359
Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_block
Medium
CVE-2025-5845
Affiliate Reviews <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter
High
CVE-2025-6043
Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-5843
Brandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-2800
WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'
Medium
CVE-2025-6977
ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function
Medium
CVE-2025-6747
Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-28965
URL Shortener <= 3.0.7 - Missing Authorization
Medium
CVE-2025-49958
Robokassa payment gateway for Woocommerce <= 1.8.1 - Reflected Cross-Site Scripting
High
CVE-2025-31422
Visual Art | Gallery WordPress Theme <= 2.4 - Authenticated (Subscriber+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.