Medium
CVE-2025-14158
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-14170
Vimeo SimpleGallery <= 0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification
Medium
CVE-2025-14062
Animated Pixel Marquee Creator <= 1.0.0 - Cross-Site Request Forgery via 'marquee' Parameter
Medium
CVE-2025-13966
Paypal Payment Shortcode <= 1.01 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttom_image' Shortcode Attribute
Medium
CVE-2025-14064
BuddyTask <= 1.3.0 - Missing Authorization to Authenticated (Subscriber+) Cross-Group Task Board Access and Manipulation
Medium
CVE-2025-12834
Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message
Medium
CVE-2025-13884
Hide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-12830
Better Elementor Addons <= 1.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slider Widget
Medium
CVE-2025-13961
Data Visualizer <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-14119
App Landing Template Blocks for WPBakery Page Builder <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-14129
Like DisLike Voting <= 1.0.1 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-13969
Reviews Sorted <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'space' Shortcode Attribute
High
CVE-2025-14044
Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie
Medium
CVE-2025-13889
Simple Nivo Slider <= 0.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-14048
SimplyConvert <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'simplyconvert_hash' Option
Medium
CVE-2025-13839
LJUsers <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'name' Shortcode Attribute
High
CVE-2025-13886
LT Unleashed <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion via 'template' Parameter
Medium
CVE-2025-14293
WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2025-66161
Grider for Elementor <= 1.0.8 - Missing Authorization
Medium
CVE-2025-66164
Laser <= 1.1.1 - Missing Authorization
Medium
CVE-2025-64240
Freshchat <= 2.3.4 - Cross-Site Request Forgery
Medium
CVE-2025-68088
Huger for Elementor <= 1.1.5 - Missing Authorization
Medium
CVE-2025-64241
Coupons and Deals <= 3.2.4 - Missing Authorization
High
CVE-2025-13820
Comments – wpDiscuz <= 7.6.39 - Unauthenticated Authentication Bypass Through Account Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.