High
CVE-2025-13070
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2025-11427
WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery
High
CVE-2025-13069
Enable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass
High
CVE-2025-13088
Category and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-12962
Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode
High
CVE-2025-12775
WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2025-12974
Gravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload
Medium
CVE-2025-12494
Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move
Medium
CVE-2025-12182
Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize
High
CVE-2025-67521
Select Core < 2.6 - Authenticated (Contributor+) Local File Inclusion
Critical
CVE-2024-52416
Debug Tool <= 2.2 - Unauthenticated Remote Code Execution
High
CVE-2025-12733
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
Medium
CVE-2025-12089
Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion
High
CVE-2025-12835
WooMulti <= 1.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-12788
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
High
CVE-2025-12846
Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
An arbitrary file upload vulnerability in the Blocksy Companion plugin for WordPress allows authenticated attackers with author-level permissions or higher to upload arbitrary files, potentially leading to remote code execution.
High
CVE-2025-11451
Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-11894
Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2025-11521
Astra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-12813
Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'
High
CVE-2025-12637
Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2025-11170
WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload
High
CVE-2025-68065
Hub Core <= 5.0.8 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-12399
Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.