Medium
CVE-2025-49058
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-49038
WP Dynamic Links <= 1.0.1 - Reflected Cross-Site Scripting
Critical
CVE-2025-7384
Database for Contact Form 7, WPforms, Elementor forms <= 1.4.3 - Unauthenticated PHP Object Injection to Arbitrary File Deletion
Low
ghsa-674p-xv2x-rf3g
Litestar has potential log injection in exception logging
Medium
CVE-2025-8874
Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via fancyBox
Medium
CVE-2025-8482
Simple Local Avatars <= 2.8.4 - Missing Authorization to Authenticated (Subscriber+) Avatar Migration
Medium
CVE-2025-8081
Elementor <= 3.30.2 - Authenticated (Administrator+) Arbitrary File Read via Image Import
High
CVE-2025-6253
UiCore Elements <= 1.3.0 - Missing Authorization to Unauthenticated Arbitrary File Read
Medium
CVE-2025-8314
Software Issue Manager <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via noaccess_msg Parameter
Critical
CVE-2025-8059
B Blocks <= 2.0.6 - Missing Authorization to Unauthenticated Privilege Escalation via rgfr_registration Function
Medium
CVE-2025-8621
Mosaic Generator <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'c' Parameter
Medium
CVE-2025-8690
Simple Responsive Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8688
Inline Stock Quotes <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via stock Shortcode
Medium
CVE-2025-8685
Wp chart generator <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpchart Shortcode
Medium
CVE-2025-4390
WP Private Content Plus <= 3.6.2 - Unauthenticated Sensitive Information Exposure
High
CVE-2025-5391
WooCommerce Purchase Orders <= 1.0.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-8568
GMap - Venturit <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'h' Parameter
Medium
CVE-2025-8462
RT Easy Builder <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-8747
Keras vulnerable to CVE-2025-1550 bypass via reuse of internal functionality
High
CVE-2025-8418
B Slider- Gutenberg Slider Block for WP <= 1.1.30 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Plugin Installation
Medium
CVE-2025-52730
WordPress Event Manager, Event Calendar and Booking Plugin <= 4.0.24 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2025-49036
Premium Addons for KingComposer <= 1.1.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-50040
CF7 Spreadsheets <= 2.3.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-64383
Qi Blocks <= 1.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.