Medium
CVE-2025-67584
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-67598
SupportCandy <= 3.4.1 - Cross-Site Request Forgery
Medium
CVE-2025-14314
PopupKit <= 2.1.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-67474
ForumWP <= 2.1.4 - Missing Authorization
Medium
CVE-2025-66077
Legal Pages <= 1.4.6 - Missing Authorization
Medium
CVE-2025-9116
WPS Visitor Counter <= 1.4.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-67929
TI WooCommerce Wishlist <= 2.10.0 - Missing Authorization
Medium
CVE-2025-66064
Giveaways and Contests by RafflePress <= 1.12.20 - Cross-Site Request Forgery
Medium
CVE-2025-63700
Clerk-js vulnerable to bypass of OAuth authentication flow by manipulating request at OTP verification stage
High
CVE-2025-64762
authkit-nextjs may let session cookies be cached in CDNs
High
CVE-2025-64755
@anthropic-ai/claude-code has Sed Command Validation Bypass that Allows Arbitrary File Writes
Medium
CVE-2025-12964
Magical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget
Medium
CVE-2025-12750
Groundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-12066
WP Delete Post Copies <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-13138
WP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function
Medium
CVE-2025-12039
BigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure
Medium
CVE-2025-13141
HT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection
Medium
CVE-2025-13149
Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification
High
CVE-2025-13156
Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution
Medium
CVE-2025-11808
Shortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11826
WP Company Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11803
WPSite Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11973
简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read
Medium
CVE-2025-11885
EchBay Admin Security <= 1.3.0 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.