Medium
CVE-2025-66136
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,089
Reset filters
Medium
CVE-2025-66147
Coder for Elementor <= 1.0.13 - Missing Authorization
Medium
CVE-2025-66135
Imager for Elementor <= 2.0.4 - Missing Authorization
Medium
CVE-2025-67468
Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms <= 1.4.6 - Missing Authorization
Medium
CVE-2025-63033
Make Section & Column Clickable For Elementor <= 2.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-62082
Generic Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-63044
Xpro Elementor Addons <= 1.4.19.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-67594
Thim Elementor Kit <= 1.3.3 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2025-67951
WPZOOM Addons for Elementor <= 1.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64274
WPKoi Templates for Elementor <= 3.4.4 - Missing Authorization
High
CVE-2025-13065
Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
Medium
CVE-2025-63055
Master Addons for Elementor <= 2.0.9.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-63077
Happy Addons for Elementor <= 3.20.3 - Missing Authorization
Medium
CVE-2025-68494
Premium Addons for Elementor <= 4.11.53 - Unauthenticated Information Exposure
Medium
CVE-2025-12358
ShopEngine <= 4.8.5 - Cross-Site Request Forgery to Wishlist Manipulation
Medium
CVE-2025-63042
Tutor LMS Elementor Addons <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-66116
Ultimate Member Widgets for Elementor <= 2.3 - Unauthenticated Information Exposure
High
CVE-2025-13692
Unlimited Elements For Elementor and Unlimited Elements For Elementor (Premium) <= 2.0 - Unauthenticated Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2025-67588
Elementor Website Builder <= 3.33.0 - Missing Authorization
Medium
CVE-2025-11363
Royal Elementor Addons and Templates <= 1.7.1036 - Missing Authorization to Unauthenticated Media File Upload
Medium
CVE-2025-12964
Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget
Medium
CVE-2025-13141
HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection
Medium
CVE-2025-12778
Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-5092
Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.