High
CVE-2025-6970
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-6975
Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
Medium
CVE-2025-49948
Super Edit <= 2.5.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-7387
Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49949
Templazee <= 1.0.2 - Missing Authorization
High
CVE-2025-6691
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
High
CVE-2025-6742
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion
Medium
CVE-2025-7059
Simple Featured Image <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via slideshow Parameter
Medium
CVE-2025-5678
Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter
Medium
CVE-2025-3780
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification
Critical
CVE-2025-4828
Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-4855
Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
Medium
CVE-2025-49945
Shortcode Generator <= 1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-32574
WPGYM <= 65.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-59557
Learts Addons < 1.7.5 - Unauthenticated SQL Injection
Medium
CVE-2025-31044
Premium SEO Pack <= 3.3.2 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-24777
Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-52803
Sala <= 1.1.3 - Missing Authorization
High
CVE-2025-59558
Billey < 2.1.6 - Unauthenticated Local File Inclusion
Critical
CVE-2025-4606
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
Medium
CVE-2025-49947
WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Reflected Cross-Site Scripting
High
CVE-2025-28982
WP Pipes <= 1.4.3 - Unauthenticated SQL Injection
Medium
CVE-2025-49946
Auto Login After Registration <= 1.0.0 - Reflected Cross-Site Scripting
High
CVE-2025-53560
Noisa <= 2.6.0 - Authenticated (Subscriber+) PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.