Medium
CVE-2025-49265
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,728
High
CVE-2025-31047
Themify Edmin <= 2.0.0 - Authenticated (Contributor+) PHP Object Injection
Critical
CVE-2025-28888
GiftXtore <= 1.7.5 - Unauthenticated Local File Inclusion
High
CVE-2025-49455
TinySalt < 3.10.0 - Unauthenticated PHP Object Injection
Critical
CVE-2025-49296
GrandPrix <= 1.6 - Unauthenticated Local File Inclusion
Critical
CVE-2025-28945
Valen - Sport, Fashion WooCommerce WordPress Theme <= 2.4 - Unauthenticated Local File Inclusion
Critical
CVE-2025-24770
CraftXtore <= 1.7 - Unauthenticated Local File Inclusion
Critical
CVE-2025-27362
Petito <= 1.6.4 - Unauthenticated Local File Inclusion
Medium
CVE-2025-53240
WordPress Photo Gallery <= 1.1.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-53239
User Registration Aide <= 1.5.3.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-49128
Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation
Medium
CVE-2025-53246
Backup and Move <= 0.1 - Missing Authorization
High
CVE-2025-53245
Logo Changer <= 1.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-47463
Stock Locations for WooCommerce <= 2.8.6 - Missing Authorization
Medium
CVE-2025-5528
Social Sharing Plugin – Sassy Social Share <= 3.3.75 - Reflected Cross-Site Scripting via 'heateor_mastodon_share' Parameter
Medium
CVE-2025-5568
WpEvently <= 4.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-9993
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Event Calendar Widget
Medium
CVE-2024-9994
Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 6.1.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Pricing Table Widget
High
CVE-2025-5303
LTL Freight Quotes – Freightview Edition <= 1.0.11, LTL Freight Quotes – Daylight Edition <=2.2.6 and LTL Freight Quotes – Day & Ross Edition <= 2.1.10 - Unauthenticated Stored Cross-Site Scripting via `expiry_date` Parameter
Medium
CVE-2025-5814
Profiler – What Slowing Down Your WP <= 1.0.0 - Missing Authentication to Unauthenticated Arbitrary Plugin Reactivation via State Restoration
Medium
CVE-2025-49009
Para Inserts Sensitive Information into Log File for Facebook authentication
High
CVE-2025-27531
Apache InLong Deserialization of Untrusted Data Vulnerability
High
CVE-2025-5806
Jenkins Gatling Plugin Vulnerable to Cross-Site Scripting (XSS)
Critical
ghsa-c42h-56wx-h85q
laravel-auth0 SDK Deserialization of Untrusted Data vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.