High
CVE-2025-28970
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-60242
Download Counter <= 1.4 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-49331
eCommerce Product Catalog <= 3.4.3 - Authenticated (Orders manager+) PHP Object Injection
Medium
CVE-2025-53228
bbpress Simple Advert Units <= 0.41 - Reflected Cross-Site Scripting
Medium
CVE-2025-5289
3D FlipBook - Lite Edition <= 1.16.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via style and mode Parameters
Medium
CVE-2025-5143
TableOn – WordPress Posts Table Filterable <= 1.0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via tableon_popup_iframe_button Shortcode
Medium
CVE-2025-6200
GeoDirectory <= 2.8.119 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2942
Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure
Medium
CVE-2025-6257
Euro FxRef Currency Converter <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via currency Shortcode
Medium
CVE-2025-49977
WP Inventory Manager <= 2.3.4 - Cross-Site Request Forgery
Medium
CVE-2025-50011
Recipes manager - WPH <= 1.0.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-49997
Giveaways and Contests by RafflePress <= 1.12.18 - Missing Authorization
Medium
CVE-2025-50049
Modern Footnotes <= 1.4.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-50008
WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily <= 1.2.4.5 - Missing Authorization
Medium
CVE-2025-49983
WPThumb <= 0.10 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2025-50015
Hand Talk <= 6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49982
WP Customer Area <= 8.2.5 - Missing Authorization
Medium
CVE-2025-49964
ClipLink <= 1.1 - Cross-Site Request Forgery
Medium
CVE-2025-49995
Download Attachments <= 1.3.1 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-50016
IP Based Login <= 2.4.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-52790
WP-DownloadCounter <= 1.01 - Cross-Site Request Forgery
Medium
CVE-2025-52733
ANON::form embedded secure form <= 1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-50027
Login/Signup Popup <= 2.9.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49979
Media Hygiene <= 4.0.2 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.