High
CVE-2025-6463
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Low
CVE-2025-4654
Soumettre.fr <= 2.1.5 - Improper Authorization to Unauthenticated Soumettre Posts Creation/Modification/Deletion
High
CVE-2025-5014
Home Villas | Real Estate WordPress Theme <= 2.8 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-5817
Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-6686
Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode
Medium
CVE-2025-6687
Magic Buttons for Elementor <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via magic-button Shortcode
High
CVE-2025-5339
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Time-Based SQL Injection via ‘bsa_pro_id'
High
CVE-2025-6437
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection via oid
High
CVE-2025-6459
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Cross-Site Request Forgery to PHP Code Injection in bsaCreateAdTemplate
High
CVE-2025-4381
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated SQL Injection
Critical
CVE-2025-4689
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution
High
CVE-2025-4380
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion
Medium
CVE-2026-15289
Booking calendar, Appointment Booking System <= 3.2.17 - Unauthenticated Time-Based SQL Injection via 'wpdevart_id'
Medium
CVE-2024-11405
WP Front-end login and register <= 2.1.0 - Reflected Cross-Site Scripting
Critical
CVE-2025-5746
Drag and Drop Multiple File Upload (Pro) - WooCommerce <= 1.7.1 and 5.0 - 5.0.5 - Unauthenticated Arbitrary File Upload
High
CVE-2025-53198
Houzez <= 4.0.4 - Unauthenticated Local File Inclusion
Medium
CVE-2025-52727
CSS3 Vertical Web Pricing Tables <= 1.9 - Reflected Cross-Site Scripting
High
CVE-2025-52832
NGG Smart Image Search <= 3.4.1 - Unauthenticated SQL Injection
High
CVE-2025-52717
LifterLMS <= 8.0.6 - Unauthenticated SQL Injection
High
CVE-2025-53204
Event List <= 1.9.2 - Unauthenticated Local File Inclusion
High
CVE-2025-52805
Leyka <= 3.31.9 - Unauthenticated Local File Inclusion
High
CVE-2025-52722
Classiera <= 4.0.34 - Unauthenticated SQL Injection
High
CVE-2025-49417
WooCommerce Product Multi-Action <= 1.3 - Unauthenticated PHP Object Injection
High
CVE-2025-5804
Case Theme User < 1.0.4 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.