Medium
CVE-2025-5956
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-7046
Portfolio for Elementor & Image Gallery | PowerFolio <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom JS
High
CVE-2025-5322
VikRentCar Car Rental Management System <= 1.4.3 - Authenticated (Administrator+) Arbitrary File Upload
High
CVE-2025-5961
Migration, Backup, Staging – WPvivid Backup & Migration <= 0.9.116 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-2537
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via ThickBox JavaScript Library
High
CVE-2025-49870
Paid Member Subscriptions <= 2.15.1 - Unauthenticated SQL Injection
High
CVE-2025-47479
WP Compress <= 6.30.30 - Unauthenticated Broken Authentication
Medium
CVE-2025-49245
Testimonials Showcase <= 1.9.16 - Reflected Cross-Site Scripting
Medium
CVE-2025-50032
Paytiko for WooCommerce <= 1.4.7 - Missing Authorization
Medium
CVE-2025-24780
Printcart Web to Print Product Designer for WooCommerce <= 2.4.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-47634
WC Pickup Store <= 1.8.9 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-53568
Radio Station <= 2.5.12 - Cross-Site Request Forgery
High
CVE-2025-23968
Graphina <= 3.1.1 - Unauthenticated Local File Inclusion
Critical
CVE-2025-49302
Easy Stripe <= 1.1 - Unauthenticated Remote Code Execution
High
CVE-2025-52830
bSecure – Your Universal Checkout <= 1.7.9 - Unauthenticated SQL Injection
Medium
CVE-2025-47565
EventON <= 4.9.9 - Missing Authorization
Medium
CVE-2025-3702
Melapress File Monitor < 2.2.0 - Missing Authorization
Medium
CVE-2025-6944
Uncode Core <= 2.9.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodes
Medium
CVE-2025-53566
WP Visitor Statistics (Real Time Traffic) <= 7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49431
MF Plus WPML <= 1.1 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-53569
Trust Payments Gateway for WooCommerce (JavaScript Library) <= 1.3.6 - Cross-Site Request Forgery
High
CVE-2025-6238
AI Engine 2.8.4 - Insecure OAuth Implementation
Medium
CVE-2025-6739
WPQuiz <= 0.4.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-49418
Allmart <= 1.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.