Critical
CVE-2025-6065
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-6070
Restrict File Access <= 1.1.2 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2025-5487
AutomatorWP <= 5.2.5 - Authenticated (Administrator+) SQL Injection via field_conditions
High
CVE-2025-3234
File Manager Pro – Filester <= 1.8.8 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-62883
Premmerce User Roles <= 1.0.13 - Missing Authorization
Medium
CVE-2025-53237
Wizard Cloak <= 1.0.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-5920
Sharable Password Protected Posts <= 1.1.0 - Unauthenticated Password protected Post Exposure
Medium
CVE-2025-6012
Auto Attachments <= 1.8.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-5815
Traffic Monitor <= 3.2.2 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-4586
IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmcalendarview' Shortcode
Medium
CVE-2025-4584
IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmeventlist' Shortcode
Medium
CVE-2025-4585
IRM Newsroom <= 1.2.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'irmflat' Shortcode
Medium
CVE-2025-5233
Color Palette <= 4.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via hex Parameter
Critical
CVE-2025-5288
REST API | Custom API Generator For Cross Platform And Import Export In WP 1.0.0 - 2.0.3 - Missing Authorization to Unauthenticated Privilege Escalation via process_handler Function
Medium
CVE-2025-5950
IndieBlocks <= 0.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via kind Parameter
Medium
CVE-2025-5939
Telegram for WP <= 1.6.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-5930
WP2HTML <= 1.0.2 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-5926
Link Shield <= 0.5.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-5938
Digital Marketing and Agency Templates Addons for Elementor <= 1.1.1 - Cross-Site Request Forgery to Import
Medium
CVE-2025-5928
WP Sliding Login/Dashboard Panel <= 2.1.1 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-5123
Contact Us Page – Contact People <= 3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via style Parameter
Medium
CVE-2025-5841
ACF Onyx Poll <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via class Parameter
Medium
CVE-2025-49377
Hydra Booking <= 1.1.9 - Missing Authorization
Medium
CVE-2025-49878
WPAdverts <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.