Medium
CVE-2025-31037
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-2940
Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-5338
Royal Elementor Addons <= 1.7.1028 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Multiple Widgets
High
CVE-2025-6212
Ultra Addons for Contact Form 7 3.5.11 - 3.5.19 - Unauthenticated Stored Cross-Site Scripting via Database module
Medium
CVE-2025-5842
Modern Design Library <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Medium
CVE-2025-6546
Drive Folder Embedder <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via tablecssclass Parameter
Medium
CVE-2025-5275
Charitable <= 1.8.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Privacy Settings
Medium
CVE-2025-5813
Amazon Products to WooCommerce <= 1.2.7 - Missing Authorization to Unauthenticated Arbitrary Product Creation
Medium
CVE-2025-6540
web-cam <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via slug Parameter
Medium
CVE-2025-5932
Homerunner <= 1.0.30 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-6537
Namasha By Mdesign <= 1.2.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via playicon_title Parameter
Medium
CVE-2025-5929
The Countdown <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via clientId Parameter
Medium
CVE-2025-6538
Post Rating and Review <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Medium
CVE-2025-5812
VG WORT METIS <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update
Medium
CVE-2025-6383
WP-PhotoNav <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via photonav Shortcode
Critical
CVE-2025-4334
Simple User Registration <= 6.3 - Unauthenticated Privilege Escalation
Medium
CVE-2025-5564
GC Social wall <= 1.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5540
Event RSVP and Simple Event Management Plugin <= 4.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-6258
WP SoundSystem <= 3.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpsstm-track Shortcode
Medium
CVE-2025-6378
Responsive Food and Drink Menu <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via display_pdf_menus Shortcode
Medium
CVE-2025-3863
Post Carousel Slider for Elementor <= 1.6.0 - Authenticated (Subscriber+) Missing Authorization via process_wbelps_promo_form Function
Medium
CVE-2025-6290
Tournament Bracket Generator <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via bracket Shortcode
Medium
CVE-2025-5559
TimeZoneCalculator <= 3.37 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5588
Image Editor by Pixo <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via download Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.