High
CVE-2025-29004
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Low
CVE-2025-53535
Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes
Medium
CVE-2025-6743
WoodMart <= 8.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-6746
WoodMart <= 8.2.3 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-7327
Widget for Google Reviews <= 1.0.15 - Authenticated (Subscriber+) Directory Traversal to Local File Inclusion
Medium
CVE-2025-5537
Lightbox & Modal Popup WordPress Plugin – FooBox <= 2.7.34 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2025-6209
LlamaIndex vulnerable to Path Traversal attack through its encode_image function
Medium
CVE-2025-6244
Essential Addons for Elementor – Popular Elementor Templates and Widgets <= 6.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via `Calendar` And `Business Reviews` Widgets
Medium
CVE-2025-5472
LlamaIndex vulnerable to DoS attack through uncontrolled recursive JSON parsing
Medium
CVE-2025-6210
LlamaIndex vulnerability in its ObsidianReader class can lead to Path Traversal exploit
High
CVE-2025-3225
LlamaIndex has an XML Entity Expansion vulnerability in its sitemap parser
Medium
CVE-2025-3044
LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions
High
CVE-2025-3046
LlamaIndex is vulnerable to Path Traversal attack through its ObsidianReader class
Medium
CVE-2025-5570
AI Engine <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter
Medium
CVE-2025-3108
LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component
Medium
CVE-2025-48339
Profiler - What Slowing Down Your WP <= 1.0.0 - Missing Authorization
Medium
CVE-2025-5957
Guest Support – Complete customer support ticket system for WordPress <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion
High
CVE-2025-30973
CoSchool LMS <= 1.4.3 - Unauthenticated PHP Object Injection
Medium
CVE-2025-31427
Invico - WordPress Consulting Business Theme <= 1.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-31055
Electrician - Electrical Service WordPress <= 1.0 - Reflected Cross-Site Scripting
High
CVE-2025-6744
Woodmart <= 8.2.3 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-31072
Ofiz - WordPress Business Consulting Theme <= 2.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-49888
PW WooCommerce On Sale! <= 1.39 - Missing Authorization
Medium
CVE-2025-52786
Media Folder <= 1.0.0 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.