Critical
ghsa-9fwj-9mjf-rhj3
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Critical
ghsa-2f4r-34m4-3w8q
Auth0 Wordpress plugin Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Critical
ghsa-9wg9-93h9-j8ch
Auth0 Symfony SDK Vulnerable to Brute Force Authentication Tags of CookieStore Sessions
Medium
CVE-2025-4669
Booking Calendar <= 10.11.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpbc Shortcode
Low
CVE-2025-22233
Spring Framework DataBinder Case Sensitive Match Exception
Medium
CVE-2025-4610
WP-Members <= 3.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpmem_user_memberships Shortcode
Critical
CVE-2025-47275
Brute Force Authentication Tags of CookieStore Sessions in Auth0-PHP SDK
High
CVE-2025-3812
WPBot Pro Wordpress Chatbot <= 13.6.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2025-4389
Crawlomatic Multipage Scraper Post Generator <= 2.6.8.1 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-4391
Echo RSS Feed Post Generator <= 5.4.8.1 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-4759
lockfile-lint-api Vulnerable to Incorrect Behavior Order
Medium
CVE-2025-4727
Meteor Affected By Inefficient Regular Expression Complexity
High
CVE-2025-48134
WP Tabs <= 2.2.12 - Authenticated (Administrator+) PHP Object Injection
Medium
CVE-2025-47512
Tainacan <= 0.21.14 - Unauthenticated Arbitrary File Deletion
High
CVE-2024-13613
Wise Chat <= 3.3.3 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2025-3888
Jupiterx Core <= 4.8.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Inline SVG
Medium
CVE-2025-48116
EventON <= 2.4.4 - Missing Authorization
Medium
CVE-2025-47619
6Storage Rentals <= 2.19.4 - Missing Authorization
Medium
CVE-2025-39498
Spotlight - Social Media Feeds (Premium) <= 1.7.1 - Unauthenticated Information Exposure
High
CVE-2025-47599
Facturante <= 1.11 - Unauthenticated SQL Injection
Medium
CVE-2025-32290
Sticky HTML5 Music Player <= 3.1.6 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-48121
WP Notes Widget <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-32296
Simple Link Directory Pro < 14.8.1 - Missing Authorization
Medium
CVE-2025-31926
Sticky Radio Player <= 3.4 - Authenticated (Contributor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.