Medium
CVE-2025-4965
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-31428
HYDRO <= 2.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-39478
Smart Notification <= 10.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-23999
Breeze <= 2.2.13 - Missing Authorization
Medium
CVE-2025-30972
Woocommerce Line Notify <= 1.1.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-25173
FastBook <= 1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-53235
Easy Social <= 1.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-47574
School Management <= 92.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-23973
SpecFit-Virtual Try On Woocommerce <= 10.0.21 - Reflected Cross-Site Scripting
High
CVE-2025-5071
AI Engine 2.8.0 - 2.8.3 - Authenticated (Subscriber+) Insufficient Authorization to Privilege Escalation via MCP
Medium
CVE-2025-49423
Bulk YouTube Post Creator <= 1.0 - Reflected Cross-Site Scripting
High
CVE-2025-6220
Ultimate Addons for Contact Form 7 <= 3.5.12 - Authenticated (Administrator+) Arbitrary File Upload via 'save_options'
High
CVE-2025-6086
CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-5237
Target Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
Critical
CVE-2025-1562
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
High
CVE-2025-4413
Pixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2025-15656
School Management <= 93.2.0 - Authenticated (Support Staff+) Privilege Escalation
Medium
CVE-2025-39486
Rankie - Wordpress Rank Tracker Plugin < 1.8.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-5291
Master Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes
Medium
CVE-2025-5700
Simple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-3515
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
Medium
CVE-2025-5673
Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter
High
CVE-2025-3774
Wise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
Medium
CVE-2025-4775
WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.