Medium
CVE-2025-14887
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-14888
Simple User Meta Editor <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via User Meta Value Field
Medium
CVE-2025-13657
HelpDesk contact form plugin <= 1.1.5 - Cross-Site Request Forgery to Settings Update via handle_query_args
High
CVE-2026-0656
iPaymu Payment Gateway for WooCommerce <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure
Medium
CVE-2025-14845
NS IE Compatibility Fixer <= 2.1.5 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14842
Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.2 - Unauthenticated Limited Arbitrary File Upload
Critical
CVE-2026-21877
n8n Vulnerable to RCE via Arbitrary File Write
Medium
CVE-2025-14901
Bit Form – Contact Form Plugin <= 2.21.6 - Missing Authorization to Unauthenticated Workflow Replay
Medium
CVE-2025-69197
Pterodactyl TOTPs can be reused during validity window
High
CVE-2025-68954
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
High
CVE-2025-14835
WP Photo Album Plus <= 9.1.05.008 - Reflected Cross-Site Scripting
Medium
CVE-2025-14468
AMP for WP – Accelerated Mobile Pages <= 1.1.9 - Cross-Site Request Forgery to Comment Submission
Medium
CVE-2025-14891
Customer Reviews for WooCommerce <= 5.93.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via displayName Parameter
Medium
CVE-2025-14059
EmailKit <= 1.6.1 - Authenticated (Author+) Arbitrary File Read via Path Traversal
Medium
CVE-2025-12648
WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files
High
CVE-2026-24635
EduBlink Core <= 2.0.7 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-67930
eHive Search <= 2.5.0 - Reflected Cross-Site Scripting
Medium
CVE-2026-22483
teachPress <= 9.0.12 - Cross-Site Request Forgery
Medium
CVE-2026-23804
Better Business Reviews <= 0.1.1 - Missing Authorization
High
CVE-2025-67934
Wellspring < 2.8 - Unauthenticated Local File Inclusion
Medium
CVE-2025-67933
Taskbuilder <= 4.0.9 - Reflected Cross-Site Scripting
Medium
CVE-2026-27327
YayMail – WooCommerce Email Customizer <= 4.3.2 - Missing Authorization
High
CVE-2025-67937
Hendon < 1.7 - Unauthenticated Local File Inclusion
Medium
CVE-2026-22472
Easy Form Builder <= 3.9.6 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.