Critical
CVE-2025-6440
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
Medium
CVE-2025-12136
Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via scan-without-login Endpoint
High
CVE-2025-10861
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-10705
MxChat – AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery
Medium
CVE-2025-11128
Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-63010
Hercules Core <= 7.4 - Authenticated (Subscriber+) Server-Side Request Forgery
Critical
CVE-2025-6327
King Addons for Elementor <= 51.1.36 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-11536
Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
High
CVE-2025-68068
Stockholm <= 9.14.1 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-62066
Revolution < 2.5.8 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-62065
RTMKit <= 1.6.5 - Authenticated (Contributor+) Arbitrary File Upload
High
CVE-2025-68067
Stockholm Core <= 2.4.6 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-64195
Eduma <= 5.7.6 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-62067
Savory <= 2.5 - Unauthenticated Local File Inclusion
Medium
CVE-2025-10750
PowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosure
Critical
CVE-2025-11391
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
A vulnerability in PPOM – Product Addons & Custom Fields for WooCommerce allows unauthenticated attackers to upload arbitrary files via the image cropper, potentially enabling remote code execution on sites with the paid version active.
Medium
CVE-2025-11703
WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning
Medium
CVE-2025-11738
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
Medium
CVE-2025-11361
Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery
High
CVE-2025-62959
Paid Videochat Turnkey Site <= 7.3.23 - Authenticated (Admin+) Remote Code Execution
High
CVE-2025-62054
Houzez Theme - Functionality <= 4.1.8 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-62053
Houzez < 4.2.0 - Unauthenticated Local File Inclusion
High
CVE-2025-62056
News Event <= 1.0.1 - Authenticated (Subscriber+) Arbitrary File Upload
High
CVE-2025-62055
Academist < 1.3 - Unauthenticated Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.