High
CVE-2025-6586
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-6786
DocCheck Login <= 1.1.5 - Unauthorized Post Access
Medium
CVE-2025-6041
yContributors <= 0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-5933
RD Contacto <= 1.4 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-5924
WP Firebase Push Notification <= 1.2.0 - Cross-Site Request Forgery to Broadcast Notification
Medium
CVE-2025-6729
PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-6787
Smart Docs <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6814
Booking X 1.0 - 1.1.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via export_now() Function
Medium
CVE-2025-6039
ProcessingJS for WordPress <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6782
GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via dirGZActiveForm()
High
CVE-2025-6783
GoZen Forms <= 1.1.5 - Unauthenticated SQL Injection via emdedSc()
High
CVE-2025-5953
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation via wp_ajax_hrm_insert_employee AJAX Action
Medium
CVE-2025-5956
WP Human Resource Management 2.0.0 - 2.2.17 - Missing Authorization to Authenticated (Employee+) Arbitrary User Deletion via ajax_delete_employee Function
Medium
CVE-2025-7046
Portfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
High
CVE-2025-5322
VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload
High
CVE-2025-5961
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-2537
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
High
CVE-2025-49870
Paid Member Subscriptions <= 2.15.1 - Unauthenticated SQL Injection
High
CVE-2025-47479
WP Compress <= 6.30.30 - Unauthenticated Broken Authentication
Medium
CVE-2025-49245
Testimonials Showcase <= 1.9.16 - Reflected Cross-Site Scripting
Medium
CVE-2025-50032
Paytiko for WooCommerce <= 1.4.7 - Missing Authorization
Medium
CVE-2025-24780
Printcart Web to Print Product Designer for WooCommerce <= 2.4.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-47634
WC Pickup Store <= 1.8.9 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-53568
Radio Station <= 2.5.12 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.