Medium
CVE-2025-13859
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2025-68001
g-FFL Checkout <= 2.1.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-22334
Woocommerce Book Price <= 1.3 - Authenticated (Subscriber++) Arbitrary File Download
Medium
CVE-2026-24594
Livemesh Addons for WPBakery Page Builder <= 3.9.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-24598
Multilanguage by BestWebSoft <= 1.5.2 - Missing Authorization
Medium
CVE-2026-40722
Yoast SEO Premium <= 26.6 - Missing Authorization
Medium
CVE-2025-69102
Test Email <= 1.1.7 - Reflected Cross-Site Scripting
High
CVE-2025-67938
Biagiotti < 3.5.2 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27042
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.2.1 - Missing Authorization
Medium
CVE-2026-24388
WPMasterToolKit <= 2.14.0 - Missing Authorization
High
CVE-2025-69099
North <= 5.7.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-24361
LearnPress – Course Review <= 4.1.9 - Authenticated (Learnpress student+) Stored Cross-Site Scripting
High
CVE-2025-68898
Synergy Project Manager <= 1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-0913
User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
High
CVE-2025-68041
Omnichannel for WooCommerce <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24595
Zoho CRM Lead Magnet <= 1.8.1.9 - Missing Authorization
Medium
CVE-2026-25472
Avada (Fusion) Builder <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-68864
Infility Global <= 2.15.36 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-69100
North <= 5.7.5 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25000
Wheel of Life <= 1.2.0 - Missing Authorization
Critical
CVE-2025-69101
Workreap Core <= 3.4.0 - Authentication Bypass
Medium
CVE-2025-68884
Simple Redirect <= 1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-68007
Event Espresso 4 Decaf <= 5.0.37.decaf - Missing Authorization to Unauthenticated Settings Change
Medium
CVE-2026-1003
GetGenie – AI Content Writer with Keyword Research & SEO Tracking Tools <= 4.3.0 - Missing Authorization to Authenticated (Author+) Arbitrary Post Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.