Medium
CVE-2025-9565
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 427
Reset filters
Medium
CVE-2025-58596
MailOptin <= 1.2.75.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-48308
Newsletter subscription optin module <= 1.2.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-52740
Boldermail <= 2.4.0 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2025-54053
Groundhogg <= 4.2.2 - Authenticated (Sales Representative+) PHP Object Injection
High
CVE-2025-54034
Newsletters <= 4.10 - Unauthenticated Local File Inclusion
Medium
CVE-2025-54035
Newsletters <= 4.10 - Cross-Site Request Forgery
High
CVE-2025-48300
Groundhogg <= 4.2.1 - Authenticated (Sales Rep+) Arbitrary File Upload
Medium
CVE-2025-39478
Smart Notification <= 10.3 - Reflected Cross-Site Scripting
Critical
CVE-2025-1562
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
Medium
CVE-2025-49871
Noptin <= 3.8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2025-39479
Smart Notification <= 10.3 - Unauthenticated SQL Injection
Medium
CVE-2025-49325
Newspack Newsletters <= 3.13.0 - Open Redirect
High
CVE-2025-4857
Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion
Medium
CVE-2025-3582
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-3581
Newsletter <= 8.8.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-3584
Newsletter <= 8.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-3107
Newsletters <= 4.9.9.8 - Authenticated (Contributor+) SQL Injection orderby Parameter
High
CVE-2025-4206
WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg <= 4.1.1.2 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2025-47547
SendPulse Email Marketing Newsletter <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-47541
Mail Mint <= 1.17.7 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-47655
theMarketer <= 1.4.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-47540
weMail <= 1.14.13 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-4172
VerticalResponse Newsletter Widget <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.