Medium
CVE-2025-4964
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-5563
WP-Addpub <= 1.2.8 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-5586
WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-5018
Hive Support <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox
Medium
CVE-2025-5019
Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function
Medium
CVE-2025-5565
Hide It <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5534
ESV Bible Shortcode for WordPress <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5538
BNS Featured Category <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2935
Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms <= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions
Critical
CVE-2025-5486
WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset
Medium
CVE-2025-5533
Knowledge Base <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5733
Modern Events Calendar <= 7.21.9 - Information Exposure
Medium
CVE-2025-49287
Product Feed for WooCommerce <= 2.2.8 - Missing Authorization
Medium
CVE-2025-49317
WP Page Loading <= 1.0.6 - Cross-Site Request Forgery
Medium
CVE-2025-1777
BM Content Builder <= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux_cb_page_options_save
Medium
CVE-2023-26001
Next Event Calendar <= 1.2 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-49288
Ultimate WP Mail <= 1.3.5 - Missing Authorization
Medium
CVE-2025-28948
Mediabay - WordPress Media Library Folders <= 1.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-30930
ACF: Yandex Maps Field <= 1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-30634
WP Featured Content Slider <= 2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49262
Sina Extension for Elementor <= 3.6.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49286
WP Table Builder <= 2.0.6 - Cross-Site Request Forgery
Medium
CVE-2025-49421
WP Text Expander <= 1.0.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-29010
Behance Portfolio Manager <= 1.7.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.