Medium
CVE-2025-62760
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 146
Reset filters
Medium
CVE-2025-69014
Youzify <= 1.3.7 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-14154
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-67582
Wbcom Designs <= 2.1.1 - Missing Authorization
Low
CVE-2025-9218
rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
Medium
CVE-2025-14064
BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation
Medium
CVE-2025-12391
Restrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update
High
CVE-2025-64207
Jannah <= 7.6.0 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-64206
Jannah <= 7.6.0 - Unauthenticated PHP Object Injection
High
CVE-2025-64205
Jannah <= 7.6.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-62949
Activity Plus Reloaded for BuddyPress <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62022
BuddyPress <= 14.3.4 - Missing Authorization
Medium
CVE-2025-58263
BuddyPress Notification Widget <= 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-53334
Jannah < 7.5.1 - Unauthenticated Local File Inclusion
Critical
CVE-2025-48158
BuddyPress XProfile Custom Image Field <= 3.0.1 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2025-50028
Ultimate Push Notifications <= 1.3.0 - Missing Authorization
High
CVE-2025-26592
Multiple Themes by axiomthemes, ThemeRex, and AncoraThemes <= 1.18.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-5526
BuddyPress Docs <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Document Read/Update
Medium
CVE-2025-30957
Activity Plus Reloaded for BuddyPress <= 1.1.2 - Missing Authorization
High
CVE-2025-47548
Wbcom Designs - Activity Link Preview For BuddyPress <= 1.4.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-39367
KLEO < 5.4.4 - Missing Authorization
Medium
CVE-2025-3793
Buddypress Force Password Change <= 0.1 - Authenticated (Subscriber+) Account Takeover via Password Update
Medium
CVE-2025-31006
Activity Reactions For Buddypress <= 1.0.22 - Reflected Cross-Site Scripting
High
CVE-2025-31033
Buddypress Humanity <= 1.2 - Cross-Site Request Forgery to Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.