Medium
CVE-2025-67580
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-66528
Thank You Page Customizer for WooCommerce <= 1.1.8 - Missing Authorization
Medium
CVE-2025-62995
MultiParcels Shipping For WooCommerce <= 1.30.12 - Missing Authorization
Medium
CVE-2025-62865
Post Cloner <= 1.0.0 - Missing Authorization
Medium
CVE-2025-66086
SMS Alert Order Notifications <= 3.8.8 - Missing Authorization
Medium
CVE-2025-67470
Portfolio and Projects <= 1.5.5 - Authenticated (Contributor+) Information Exposure
Medium
CVE-2025-62739
Add Custom Codes <= 4.80 - Cross-Site Request Forgery
High
CVE-2025-65959
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Medium
CVE-2025-13620
Wp Social Login and Register Social Counter <= 3.1.3 - Missing Authorization in Cache REST Endpoints to Social Counter Tampering
High
CVE-2025-12851
My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller
Medium
CVE-2025-13682
Trail Manager <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-12879
User Generator and Importer <= 1.2.2 - Cross-Site Request Forgery to Privilege Escalation via Arbitrary Administrator Account Creation
Medium
CVE-2025-12876
Projectopia – WordPress Project Management <= 5.1.19 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
High
CVE-2025-13614
Cool Tag Cloud <= 2.29 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13739
CryptX <= 4.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13678
Thai Lottery Widget <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
Medium
CVE-2025-13684
ARK Related Posts <= 2.19 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12130
WC Vendors – WooCommerce Multivendor, WooCommerce Marketplace, Product Vendors <= 2.6.4 - Cross-Site Request Forgery to Vendor Product Deletion
High
CVE-2025-12850
My auctions allegro <= 3.6.32 - Unauthenticated SQL Injection via auction_id
Critical
CVE-2025-66516
Apache Tika has XXE vulnerability
Low
CVE-2025-63681
open-webui is Vulnerable to Incorrect Access Control
Medium
CVE-2025-12186
Weekly Planner <= 1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Critical
CVE-2025-12374
Email Verification, Email OTP, Block Spam Email, Passwordless login, Hide Login, Magic Login – User Verification <= 2.0.44 - Authentication Bypass to Account Takeover
Medium
CVE-2025-12354
Live CSS Preview <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.