Critical
ghsa-98j6-67v3-mw34
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,728
Medium
CVE-2025-5093
Responsive Lightbox & Gallery <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49510
Min Max Step Quantity Limits Manager for WooCommerce <= 5.1.0 - Cross-Site Request Forgery
Medium
CVE-2025-5194
WP Map Block <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49509
Audio Editor & Recorder <= 2.2.1 - Missing Authorization
Medium
CVE-2025-5526
BuddyPress Docs <= 2.2.4 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Document Read/Update
Medium
CVE-2025-49511
Civi Framework <= 2.1.6.3 - Cross-Site Request Forgery
Medium
CVE-2025-49274
Neom Blog <= 0.0.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-5035
Firelight Lightbox <= 2.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5239
Domain For Sale <= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter
Medium
CVE-2025-5760
Simple History <= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode
Medium
CVE-2025-5703
StageShow <= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter
Medium
CVE-2025-5699
Developer Formatter <= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS
Medium
CVE-2025-5686
Paged Gallery <= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5541
Runners Log <= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-4966
WP Online Users Stats <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk_dataset_results Function
Medium
CVE-2025-4964
WP Online Users Stats <= 1.0.0 - Authenticated (Editor+) SQL Injection via table_name Parameter
Medium
CVE-2025-5563
WP-Addpub <= 1.2.8 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-5586
WordPress Ajax Load More and Infinite Scroll <= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-5018
Hive Support <= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs_update_ai_chat_settings and hive_lite_support_get_all_binbox
Medium
CVE-2025-5019
Hive Support <= 1.2.5 - Cross-Site Request Forgery via hs_update_ai_chat_settings Function
Medium
CVE-2025-5565
Hide It <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5534
ESV Bible Shortcode for WordPress <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5538
BNS Featured Category <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.