Medium
CVE-2025-39482
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-31640
Magic Responsive Slider and Carousel WordPress <= 1.6 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-31630
The Business <= 1.6.1 - Missing Authorization
Medium
CVE-2025-32180
CSS3 Tooltips for WordPress <= 1.8 - Missing Authorization
Medium
CVE-2025-47557
MapSVG <= 8.5.31 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-47637
STAGGS <= 2.11.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-48120
MapSVG Lite <= 8.6.9 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-32306
Radio Player Shoutcast & Icecast WordPress Plugin <= 4.4.6 - Authenticated (Contributor+) SQL Injection
High
CVE-2025-39481
Eventer <= 3.9.6 - Unauthenticated SQL Injection
Medium
CVE-2025-31922
CSS3 Accordions for WordPress <= 3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-60248
WPC Product Options for WooCommerce < 3.1.3 - Authenticated (Subscriber+) Local File Inclusion
High
CVE-2025-47693
FAT Services Booking <= 5.5 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-1647
Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components
Medium
CVE-2025-47778
Sulu vulnerable to XXE in SVG File upload Inspector
Low
CVE-2025-47279
undici Denial of Service attack via bad certificate data
Low
CVE-2025-32421
Next.js Race Condition to Cache Poisoning
Medium
CVE-2025-47492
Drag and Drop File Upload for Elementor Forms <= 1.4.3 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2025-47529
Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-32920
TI WooCommerce Wishlist <= 2.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-51666
Tours <= 1.0.0 - Missing Authorization
Medium
CVE-2025-47583
Salon booking system <= 10.16 - Cross-Site Request Forgery to Arbitrary Post/Page Deletion
Medium
CVE-2025-4169
Posts per Cat [Unmaintained] <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-32922
WP2LEADS <= 3.5.0 - Cross-Site Request Forgery
Medium
CVE-2025-47580
Front End Users <= 3.2.32 - Missing Authorization to Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.