Critical
CVE-2025-31069
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-48257
Projectopia <= 5.1.17 - Missing Authorization
Medium
CVE-2025-3581
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-2892
All in One SEO Pack <= 4.8.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta Description and Canonical URL
Medium
CVE-2025-60247
Bux Woocommerce <= 1.2.3 - Missing Authorization
Medium
CVE-2025-3715
Bold Page Builder <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-text' Parameter
Medium
CVE-2025-4669
Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
Medium
CVE-2025-4610
WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode
High
CVE-2025-3812
WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2025-4389
Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-4391
Echo RSS Feed Post Generator <= 5.4.8.1 - Unauthenticated Arbitrary File Upload
High
CVE-2025-48134
WP Tabs <= 2.2.12 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2025-47512
Tainacan <= 0.21.14 - Unauthenticated Arbitrary File Deletion
High
CVE-2024-13613
Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2025-3888
Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
Medium
CVE-2025-48116
EventON <= 2.4.4 - Missing Authorization
Medium
CVE-2025-47619
6Storage Rentals <= 2.19.4 - Missing Authorization
Medium
CVE-2025-39498
Spotlight - Social Media Feeds (Premium) <= 1.7.1 - Unauthenticated Information Exposure
High
CVE-2025-47599
Facturante <= 1.11 - Unauthenticated SQL Injection
Medium
CVE-2025-32290
Sticky HTML5 Music Player <= 3.1.6 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-48121
WP Notes Widget <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-32296
Simple Link Directory Pro < 14.8.1 - Missing Authorization
Medium
CVE-2025-31926
Sticky Radio Player <= 3.4 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-31068
Seven Stars <= 1.4.4 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.