Medium
CVE-2025-32544
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-22269
Real Testimonials <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-1456
Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated DOM-Based (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-3418
WPC Admin Columns 2.0.6 - 2.1.0 - Authenticated (Subscriber+) Privilege Escalation via User Meta Update
Medium
CVE-2025-26867
Bulk <= 1.0.11 - Missing Authorization
Medium
CVE-2025-1455
Royal Elementor Addons and Templates <= 1.7.1012 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-3513
SureForms <= 1.4.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-26990
Royal Elementor Addons <= 1.7.1006 - Authenticated (Admin+) Server Side Request Forgery
Medium
CVE-2025-26950
Nepali Date Converter <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-32562
WP Easy Poll <= 2.2.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-26997
Wireless Butler <= 1.0.11 - Reflected Cross-Site Scripting
Medium
CVE-2025-26743
Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting
Medium
CVE-2025-32593
Add Product Frontend for WooCommerce <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Medium
CVE-2025-22268
Uncanny Toolkit for LearnDash <= 3.7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2871
WordPress Mega Menu – QuadMenu <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update
Medium
CVE-2025-26870
JetEngine <= 3.6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-26748
Arkhe <= 3.11.0 - Cross-Site Request Forgery to Local File Inclusion
High
CVE-2025-27011
Booking and Rental Manager <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-26740
SpaBiz <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2541
WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2025-2575
Z Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2025-2128
Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter
High
CVE-2025-3434
SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
Medium
CVE-2025-62077
Affiliate Link Tracker <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.