Medium
CVE-2025-49034
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-28953
smart SEO <= 4.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-52819
Pakke Envíos <= 1.0.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-52804
Nuss <= 1.3.3 - Missing Authorization
High
CVE-2025-24779
Yogi < 2.9.3 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-49884
Internal Linking of Related Contents <= 1.1.8 - Missing Authorization
High
CVE-2025-60211
WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2025-29004
Responsive Coming Soon Landing Page / Holding Page for WordPress <= 3.0 - Authenticated (Susbcriber+) Privilege Escalation
Medium
CVE-2025-6743
WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6746
WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-7327
Widget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion
Medium
CVE-2025-5537
Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-6244
Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets
Medium
CVE-2025-5570
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
Medium
CVE-2025-48339
Profiler - What Slowing Down Your WP <= 1.0.0 - Missing Authorization
Medium
CVE-2025-5957
Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion
High
CVE-2025-30973
CoSchool LMS <= 1.4.3 - Unauthenticated PHP Object Injection
Medium
CVE-2025-31427
Invico - WordPress Consulting Business Theme <= 1.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-31055
Electrician - Electrical Service WordPress <= 1.0 - Reflected Cross-Site Scripting
High
CVE-2025-6744
Woodmart <= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-31072
Ofiz - WordPress Business Consulting Theme <= 2.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-49888
PW WooCommerce On Sale! <= 1.39 - Missing Authorization
Medium
CVE-2025-52786
Media Folder <= 1.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-49944
WPCode Content Ratio <= 2.0 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.