Medium
CVE-2025-3429
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-32243
Internal Link Optimiser <= 5.1.2 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-2568
Vayu Blocks – Gutenberg Blocks for WordPress & WooCommerce 1.0.4 - 1.2.1 - Missing Authorization to Unauthenticated Limited Arbitrary Options Update
Medium
CVE-2025-3432
AAWEP Obfuscator <= 1.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-3427
3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'infill_text'
Medium
CVE-2025-32116
QR Master <= 1.0.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-32117
Widgetize Pages Light <= 3.0 & Widgets as Shortcodes <= 5.9.10 - Reflected Cross-Site Scripting
Medium
CVE-2024-13688
Admin and Site Enhancements (ASE) <= 7.6.9 - Password Protection Bypass
High
CVE-2025-2526
Streamit <= 4.0.2 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
Critical
CVE-2025-32013
LNbits Lightning Network Payment System Vulnerable to Server-Side Request Forgery via LNURL Authentication Callback
Medium
CVE-2025-1264
Broken Link Checker by AIOSEO <= 1.2.3 - Authenticated (Contributor+) SQL Injection
Critical
CVE-2025-2941
Drag and Drop Multiple File Upload for WooCommerce <= 1.1.4 - Unauthenticated Arbitrary File Move
High
CVE-2024-13776
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update and Settings Manipulation
Medium
CVE-2025-2789
MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution <= 4.2.19 - Missing Authorization to Unauthenticated Table Rates Deletion
High
CVE-2025-31487
The XWiki JIRA extension allows data leak through an XXE attack by using a fake JIRA server
Medium
CVE-2025-31486
Vite allows server.fs.deny to be bypassed with .svg or relative paths
High
CVE-2025-31485
GraphQL grant on a property might be cached with different objects
High
CVE-2025-31481
GraphQL query operations security can be bypassed
High
CVE-2025-31119
generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework
High
CVE-2024-13604
KB Support – Customer Support Ticket & Helpdesk Plugin, Knowledge Base Plugin <= 1.7.4 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2025-2544
AI Content Pipelines <= 1.6 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2025-0810
Read More & Accordion <= 3.4.7 - Cross-Site Request Forgery to Local File Inclusion
High
CVE-2025-2933
Email Notifications for Updates <= 1.1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2025-2889
Link Library <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Additional Parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.