Medium
CVE-2025-5700
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2025-3515
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
Medium
CVE-2025-5673
Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter
High
CVE-2025-3774
Wise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
Medium
CVE-2025-4775
WordPress Infinite Scroll – Ajax Load More <= 7.4.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48111
YITH PayPal Express Checkout for WooCommerce <= 1.49.0 - Cross-Site Request Forgery
Medium
CVE-2025-3880
Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update
Medium
CVE-2025-49929
Ultimate Blocks <= 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-49330
Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.3.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-49234
WP Dummy Content Generator <= 3.4.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
Medium
CVE-2025-49316
WP2LEADS <= 3.5.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-52762
flexo-posts-manager <= 1.0001 - Reflected Cross-Site Scripting
Medium
CVE-2025-52764
flexoslider <= 1.0004 - Reflected Cross-Site Scripting
Medium
CVE-2026-28136
SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-5337
Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter
Medium
CVE-2025-5238
YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Medium
CVE-2025-4667
Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2025-5589
StreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter
Medium
CVE-2025-5336
Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter
High
CVE-2025-4200
Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-4187
UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-6062
Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-6063
XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-6064
WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.