Medium
CVE-2025-14446
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2025-14397
Postem Ipsum <= 3.0.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation in postem_ipsum_generate_users
Medium
CVE-2025-14367
Easy Theme Options <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Import
High
CVE-2025-14475
Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameter
Medium
CVE-2025-14447
AnnunciFunebri Impresa <= 4.7.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Options Deletion
Medium
CVE-2025-14365
Eyewear prescription form <= 7.0.2 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Category Deletion
Medium
CVE-2025-14366
Eyewear prescription form <= 7.0.2 - Missing Authorization to Unauthenticated Arbitrary WooCommerce Product Creation
Medium
CVE-2025-14288
Gallery Blocks with Lightbox <= 3.3.0 - Missing Authorization to Authenticated (Contributor+) Plugin Settings Modification
Medium
CVE-2025-9873
a3 Lazy Load <= 2.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-11693
Export WP Page to Static HTML & PDF <= 4.3.4 - Unauthenticated Cookie Exposure via Log File
Medium
CVE-2025-11376
Colibri Page Builder <= 1.0.335 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
CVE-2025-9218
rtMedia for WordPress, BuddyPress and bbPress 4.7.0 - 4.7.3 - Missing Authorization to Unauthenticated Information Disclosure via handle_rest_pre_dispatch Function
Medium
CVE-2025-8617
YITH WooCommerce Quick View <= 2.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yith_quick_view Shortcode
Medium
CVE-2025-7058
Kingcabs <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via progressbarLayout Parameter
High
CVE-2025-54981
Apache StreamPark uses a Weak Encryption Algorithm
High
CVE-2025-54947
Apache StreamPark has a hard-coded encryption key
Medium
CVE-2025-11164
Mavix Education <= 1.0 - Missing Authorization to Authenticated (Subscriber+) 'Creativ Demo Importer' Plugin Activation
Medium
CVE-2025-12077
WP to LinkedIn Auto Publish <= 1.9.8 - Reflected Cross-Site Scripting via PostMessage
Medium
CVE-2025-12109
Header Footer Script Adder – Insert Code in Header, Body & Footer <= 2.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11707
Login Lockdown & Protection <= 2.14 - IP Block Bypass
Medium
CVE-2025-11970
Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery
Medium
CVE-2025-12076
Social Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage
High
CVE-2025-13089
WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection
Medium
CVE-2025-14477
404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.