Medium
CVE-2025-13355
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2025-7402
Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.95 - Unauthenticated SQL Injection via site_id
Medium
CVE-2025-12800
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.5 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2025-66092
Accordion Slider <= 1.9.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-67517
ArtPlacer Widget <= 2.22.9.2 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-49335
External Media <= 1.0.36 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2025-66093
Extensions for Leaflet Map <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-24938
Better Search <= 4.2.1 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2026-24939
Modula Image Gallery <= 2.13.6 - Missing Authorization
Medium
CVE-2025-64268
Timetics <= 1.0.44 - Missing Authorization
Medium
CVE-2025-66071
Custom Order Numbers for WooCommerce <= 1.11.0 - Missing Authorization
Medium
CVE-2025-12696
HelloLeads CRM Form Shortcode <= 1.0 - Missing Authorization to Unauthenticated Settings Reset
High
CVE-2025-13526
OneClick Chat to Order <= 1.0.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-13318
Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter
Medium
CVE-2025-13136
GSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure
Medium
CVE-2025-12877
IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion
Medium
CVE-2025-62609
MLX has Wild Pointer Dereference in load_gguf()
Medium
CVE-2025-62608
MLX has heap-buffer-overflow in load()
Medium
CVE-2025-13317
Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter
High
CVE-2025-13384
CP Contact Form with PayPal <= 1.3.56 - Missing Authorization to Unauthenticated Arbitrary Payment Confirmation
Medium
CVE-2025-12752
Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation
Medium
CVE-2025-11186
Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-11087
Zegen Core <= 2.0.1 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2025-10684
Construction Light <= 1.6.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Activation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.