Medium
CVE-2025-28949
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
High
CVE-2025-60203
Store Exporter <= 2.7.6 - Unauthenticated Local File Inclusion
High
CVE-2025-60232
KBx Pro Ultimate <= 8.0.5 - Unauthenticated PHP Object Injection
Medium
CVE-2025-60075
hpb seo plugin for WordPress <= 3.0.1 - Reflected Cross-Site Scripting
High
CVE-2025-60204
WooCommerce Store Toolkit <= 2.4.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-47645
ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes <= 1.4.9 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-5284
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-4369
Companion Auto Update <= 3.9.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via update_delay_days parameter
Medium
CVE-2025-7367
Strong Testimonials <= 3.2.11 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Fields
Critical
CVE-2025-7340
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-7360
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Directory Traversal to Arbitrary File Move
Critical
CVE-2025-7341
HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. <= 2.2.1 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-10134
Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-5393
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.5 - Missing Authorization to Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-5394
Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Critical
CVE-2025-60207
Custom User Registration Fields for WooCommerce <= 2.1.2 - Unauthenticated Arbitrary File Upload
High
CVE-2025-7667
Restrict File Access <= 1.1.2 - Cross-Site Request Forgery to Arbitrary File Deletion
Medium
CVE-2025-49954
WP-Click-Tracker <= 0.7.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-49955
Smart Flexslider <= 2.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-60239
CoSchool LMS <= 1.4.3 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-49956
Fade Slider <= 2.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-49957
Email Attachment by Order Status & Products <= 1.0.1 - Reflected Cross-Site Scripting
High
CVE-2025-53194
JetEngine <= 3.7.1 - Authenticated (Contributor+) Server-Side Template Injection to Remote Code Execution
Medium
CVE-2025-49373
Evergreen Content Poster <= 1.4.5 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.