High
CVE-2025-58973
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,089
Reset filters
Medium
CVE-2025-57955
Post Carousel Slider for Elementor <= 1.7.0 - Missing Authorization
Medium
CVE-2025-57932
PowerFolio <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-57939
Image Hover Effects – Elementor Addon <= 1.4.4 - Missing Authorization
Medium
CVE-2025-59592
Make Column Clickable Elementor <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58222
Team Manager <= 2.3.16 - Missing Authorization
Medium
CVE-2025-58251
Sticky Header Effects for Elementor <= 2.1.3 - Missing Authorization
High
CVE-2025-10380
Advanced Views – Display Posts, Custom Fields, and More <= 3.7.19 - Authenticated (Author+) Remote Code Execution via SSTI
Medium
CVE-2025-57999
WPKoi Templates for Elementor <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-59553
Custom iFrame for Elementor <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-57961
CoDesigner <= 4.30 - Missing Authorization
Medium
CVE-2025-59574
WP Travel Engine <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58017
Ultimate Store Kit Elementor Addons <= 2.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64352
Essential Addons for Elementor <= 6.2.4 - Missing Authorization
Medium
CVE-2025-9203
Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields
Medium
CVE-2025-8446
Blaze Demo Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install
Medium
CVE-2025-9703
Ultimate Addons for Elementor Lite <= 2.4.9 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
High
CVE-2025-62019
Recipe Card Blocks for Gutenberg & Elementor <= 3.4.8 - Incorrect Authorization
Medium
CVE-2025-8445
Countdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'
Medium
CVE-2025-8481
Blog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery
Medium
CVE-2025-8215
Responsive Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-8388
PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'
Medium
CVE-2025-8564
SKT Addons for Elementor <= 3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-8149
aThemes Addons for Elementor Lite <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.