Medium
CVE-2025-4588
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-6754
SEO Metrics <= 1.0.15 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-8152
WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons <= 1.7.0 - Missing Authorization to Unauthenticated Sticky Status Update
Critical
CVE-2025-54782
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
Medium
CVE-2025-51504
Microweber XSS Vulnerability in the homepage Endpoint
Medium
CVE-2025-51502
Microweber has Reflected XSS Vulnerability in the layout Parameter
Medium
CVE-2025-51501
Microweber has Reflected XSS Vulnerability in the id Parameter
Medium
ghsa-2rjv-cv85-xhgm
OpenSearch unauthorized data access on fields protected by field level security if field is a member of an object
Medium
ghsa-rrmm-wq7q-h4v5
OpenSearch unauthorized data access on fields protected by field masking for fields of type ip, geo_point, geo_shape, xy_point, xy_shape
Medium
CVE-2025-8146
Qi Addons for Elementor <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via TypeOut Text Widget
Medium
CVE-2025-6722
BitFire <= 4.5 - Unauthenticated Information Exposure
Medium
CVE-2025-6626
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL
Medium
CVE-2025-8281
WP Talroo <= 2.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-7694
Woffice Core <= 5.4.26 - Authenticated (Contributor+) Arbitrary File Deletion
High
CVE-2025-49386
Preserve Code Formatting <= 4.0.1 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-4684
BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites <= 3.2.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Carousel and Image Slider Widgets
Low
CVE-2025-45769
php-jwt contains weak encryption
Medium
CVE-2025-6228
Sina Extension for Elementor <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Sina Posts`, `Sina Blog Post` and `Sina Table` Widgets
High
CVE-2025-45768
pyjwt v2.10.1 was discovered to contain weak encryption. NOTE: this is disputed by the Supplier because the key length is chosen by the application that uses the library (admittedly, library users may
Low
CVE-2025-51503
Microweber Has Stored XSS Vulnerability in User Profile Fields
Medium
CVE-2025-7646
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7845
Stratum – Elementor Widgets <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Google Maps and Image Hotspot Widgets
Medium
CVE-2025-4523
IDonate 2.0.0 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via admin_donor_profile_view Function
High
CVE-2025-7725
Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery – Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI <= 26.1.0 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.