Medium
CVE-2025-7059
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-5678
Kadence Blocks – Gutenberg Blocks for Page Builder Features <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via `redirectURL` Parameter
Medium
CVE-2025-3780
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification
Critical
CVE-2025-4828
Support Board <= 3.8.0 - Unauthenticated Arbitrary File Deletion
Critical
CVE-2025-4855
Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key
Medium
CVE-2025-49945
Shortcode Generator <= 1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-32574
WPGYM <= 65.0 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-59557
Learts Addons < 1.7.5 - Unauthenticated SQL Injection
Medium
CVE-2025-31044
Premium SEO Pack <= 3.3.2 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-24777
Hillter <= 3.0.7 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-52803
Sala <= 1.1.3 - Missing Authorization
High
CVE-2025-59558
Billey < 2.1.6 - Unauthenticated Local File Inclusion
Critical
CVE-2025-4606
Sala - Startup & SaaS WordPress Theme <= 1.1.4 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
Medium
CVE-2025-49947
WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Reflected Cross-Site Scripting
High
CVE-2025-28982
WP Pipes <= 1.4.3 - Unauthenticated SQL Injection
Medium
CVE-2025-49946
Auto Login After Registration <= 1.0.0 - Reflected Cross-Site Scripting
High
CVE-2025-53560
Noisa <= 2.6.0 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-49034
Funnel Builder by FunnelKit <= 3.10.2 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-28953
smart SEO <= 4.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-52819
Pakke Envíos <= 1.0.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-52804
Nuss <= 1.3.3 - Missing Authorization
High
CVE-2025-24779
Yogi < 2.9.3 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-49884
Internal Linking of Related Contents <= 1.1.8 - Missing Authorization
High
CVE-2025-60211
WooCommerce Registration Fields Plugin - Custom Signup Fields <= 3.2.3 - Authenticated (Subscriber+) Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.