Medium
CVE-2025-4220
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-3860
CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter
Medium
CVE-2025-4055
Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode
High
CVE-2025-4335
Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation
Critical
CVE-2025-3844
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover
Medium
CVE-2025-3924
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration
High
CVE-2025-3921
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
Medium
CVE-2025-3851
Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-2821
Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification
High
CVE-2025-0853
PGS Core <= 5.8.0 - Unauthenticated SQL Injection
High
CVE-2025-0856
PGS Core <= 5.8.0 - Missing Authorization via Multiple Functions
Medium
CVE-2024-12120
Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-0855
PGS Core <= 5.8.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-3853
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation
Medium
CVE-2025-3782
Cision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-2011
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
High
CVE-2025-2802
LayoutBoxx <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-4337
AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion
High
CVE-2025-3610
Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update
Medium
CVE-2025-3609
Reales WP STPT <= 2.1.2 - Unauthorized User Registration
High
CVE-2025-4279
External image replace <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload
High
CVE-2025-60221
Captivate Sync <= 3.0.3 - Unauthenticated PHP Object Injection
Critical
CVE-2025-1909
BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider
Medium
CVE-2025-3281
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.