High
CVE-2025-47608
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,687
Medium
CVE-2025-5532
Faculty Staff and Student Directory Plugin – Campus Directory <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-47586
Motors - Events <= 1.4.7 - Unauthenticated Local File Inclusion
Medium
CVE-2025-5531
Staff Directory – Employee Directory for WordPress <= 4.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-48281
MyStyle Custom Product Designer <= 3.21.1 - Unauthenticated SQL Injection
Critical
CVE-2025-39475
Arlo <= 6.0.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-5340
Music Player for Elementor <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via album_buy_url Parameter
Medium
CVE-2025-4205
Popup Maker <= 1.20.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via popupID Parameter
Medium
CVE-2025-4671
Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
High
CVE-2025-4392
Shared Files <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function
Medium
CVE-2025-4420
Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter
Medium
CVE-2025-1725
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads
Medium
CVE-2025-5116
WP Plugin Info Card <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via containerid Parameter
Medium
CVE-2025-5103
Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function
Medium
CVE-2024-8008
WSO2 products vulnerable to Cross-site Scripting
Medium
CVE-2024-1440
WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint
Critical
CVE-2025-4797
Golo <= 1.7.0 - Authentication Bypass to Account Takeover
Medium
CVE-2025-4047
Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View
Critical
CVE-2025-1750
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
Medium
CVE-2025-3919
WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Critical
Exploited in attacks
CVE-2025-49113
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
Medium
CVE-2025-5420
juzaweb CMS allows cross-site scripting by uploading an SVG file
Medium
CVE-2025-48133
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.4.0.2 - Missing Authorization
High
CVE-2025-49072
Mr. Murphy - Custom Dress Tailoring Clothing WordPress Theme < 1.2.12.1 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.