Medium
CVE-2025-48111
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-3880
Poll, Survey & Quiz Maker Plugin by Opinion Stage <= 19.9.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update
Medium
CVE-2025-49929
Ultimate Blocks <= 3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-49330
Integration for Contact Form 7 and Zoho CRM, Bigin <= 1.3.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-49234
WP Dummy Content Generator <= 3.4.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
Medium
CVE-2025-49316
WP2LEADS <= 3.5.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-52762
flexo-posts-manager <= 1.0001 - Reflected Cross-Site Scripting
Medium
CVE-2025-52764
flexoslider <= 1.0004 - Reflected Cross-Site Scripting
Medium
CVE-2026-28136
SMS <= 6.9.12 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-5337
Slider, Gallery, and Carousel by MetaSlider <= 3.98.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via aria-label Parameter
Medium
CVE-2025-5238
YITH WooCommerce Wishlist <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Medium
CVE-2025-4667
Simply Schedule Appointments <= 1.6.8.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2025-5589
StreamWeasels Kick Integration <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via status-classic-offline-text Parameter
Medium
CVE-2025-5336
Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter
High
CVE-2025-4200
Zagg - Electronics & Accessories WooCommerce WordPress Theme <= 1.4.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-4187
UserPro - Community and User Profile WordPress Plugin <= 5.1.10 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-6062
Yougler Blogger Profile Page <= v1.01 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-6063
XiSearch bar <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-6064
WP URL Shortener <= 1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-6055
Zen Sticky Social <= 0.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-6040
Easy Flashcards <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-4216
DIOT SCADA with MQTT <= 1.0.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-4592
AI Image Lab – Free AI Image Generator <= 1.0.6 - Cross-Site Request Forgery to API Key Update
Medium
CVE-2025-6061
kk Youtube Video <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.