Medium
CVE-2025-26743
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-32593
Add Product Frontend for WooCommerce <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Content Deletion
Medium
CVE-2025-22268
Uncanny Toolkit for LearnDash <= 3.7.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2871
WordPress Mega Menu – QuadMenu <= 3.2.0 - Cross-Site Request Forgery to Limited User Meta Update
Medium
CVE-2025-26870
JetEngine <= 3.6.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-26748
Arkhe <= 3.11.0 - Cross-Site Request Forgery to Local File Inclusion
High
CVE-2025-27011
Booking and Rental Manager <= 2.2.8 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-26740
SpaBiz <= 1.0.18 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2541
WP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2025-2575
Z Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2025-2128
Cost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter
Medium
ghsa-256q-hx8w-xcqx
Silverstripe Framework user enumeration via timing attack on login and password reset forms
High
CVE-2025-3434
SMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs
Medium
CVE-2025-30148
Silverstripe Framework has a XSS vulnerability in HTML editor
Medium
CVE-2025-25197
Silverstripe cross-site scripting (XSS) attack in elemental "Content blocks in use" report
High
ghsa-cj3w-g42v-wcj6
ibexa/fieldtype-richtext allows access to external entities in XML
High
ghsa-2jqj-5qv2-xvcg
ezsystems/ezplatform-richtext allows access to external entities in XML
Medium
CVE-2025-62077
Affiliate Link Tracker <= 0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Critical
Exploited in attacks
CVE-2024-58136
yiisoft/yii2 Mishandles the Attaching of Behavior Defined by a `__class` Array Key
Medium
CVE-2025-32531
Arconix FAQ <= 1.9.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-32515
Terminal Africa <= 1.13.17 - Reflected Cross-Site Scripting
Medium
CVE-2025-32639
Affiliate Links Lite <= 3.1.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-26955
Industrial Lite <= 1.0.8 - Missing Authorization
Medium
CVE-2025-31006
Activity Reactions For Buddypress <= 1.0.22 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.