Medium
CVE-2025-49074
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,687
High
CVE-2025-48124
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Unauthenticated Arbitrary File Download
High
CVE-2025-31643
WPCHURCH <= 2.7.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-48328
Real Time Validation for Gravity Forms <= 1.7.0 - Cross-Site Request Forgery
Medium
CVE-2025-49076
The Plus Addons for Elementor Page Builder Lite <= 6.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-3813
Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5292
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Medium
CVE-2025-5125
Custom Post Carousels with Owl <= 1.4.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48334
Woo Slider Pro <= 1.12 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Medium
CVE-2025-48331
WooCommerce Orders & Customers Exporter <= 5.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-48329
Real Time Validation for Gravity Forms <= 1.7.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-5290
Borderless – Elementor Addons and Templates <= 1.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-4857
Newsletters <= 4.9.9.9 - Authenticated (Administrator+) Local File Inclusion
Medium
CVE-2025-49077
Dynamic Pricing and Discount Rules <= 2.2.9 - Cross-Site Request Forgery
High
CVE-2025-32283
Solar Energy <= 3.5 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-31920
WP Guppy <= 4.3.3 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2025-32291
SUMO Affiliates Pro < 11.1.0 - Unauthenticated Arbitrary File Upload
High
CVE-2025-47601
MaxiBlocks <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Medium
CVE-2025-47598
History Log by click5 <= 1.0.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-49075
Wishlist <= 1.0.43 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-31059
WBW Product Table PRO <= 2.2.6 - Unauthenticated SQL Injection
Critical
CVE-2025-48267
WP Pipes <= 1.4.2 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2025-47694
Blog Designer PRO for WordPress <= 3.4.7 - Reflected Cross-Site Scripting
Medium
CVE-2025-4944
LA-Studio Element Kit for Elementor <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Compare and Google Maps Widgets
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.