Medium
CVE-2025-67472
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2025-12733
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
Medium
CVE-2025-64218
Passster <= 4.2.19 - Unauthenticated Information Exposure
Medium
CVE-2025-12954
Timetable and Event Schedule by MotoPress <= 2.4.15 - Insecure Direct Object Reference to Authenticated (Contributor+) Event Disclosure
Medium
CVE-2025-12377
Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions
Medium
CVE-2025-64293
0 Day Analytics <= 4.0.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-12681
Comment Edit Core – Simple Comment Editing <= 3.1.0 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12979
Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-12089
Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion
Medium
CVE-2025-11454
Specific Content For Mobile – Customize the mobile version without redirections <= 0.5.5 - Authenticated (Contributor+) SQL Injection
High
CVE-2025-11994
Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-12732
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33 - Missing Authorization to Authenticated (Author+) Sensitive Information Exposure
High
CVE-2025-12903
Payment Plugins Braintree For WooCommerce <= 3.2.78 - Missing Authorization to Payment Token Exposure and Transaction Fraud
High
CVE-2025-12633
Booking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe Connection
Medium
CVE-2025-12018
MembershipWorks <= 6.14 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-12113
Alt Text Generator AI – Auto Generate & Bulk Update Alt Texts For Images <= 1.8.3 - Missing Authorization to Authenticated (Subscriber+) API Key Deletion
Medium
CVE-2025-12087
Wishlist and Save for later for Woocommerce <= 1.1.22 - Insecure Direct Object Reference to Authenticated (Subscriber+) Wishlist Item Deletion
Medium
CVE-2025-12901
Asgaros Forum <= 3.2.1 - Cross-Site Request Forgery to Subscription Settings Update
Medium
CVE-2025-64217
Photography <= 7.7.2 - Reflected Cross-Site Scripting
High
CVE-2025-12835
WooMulti <= 1.7 - Authenticated (Subscriber+) Arbitrary File Deletion
Medium
CVE-2025-13000
DB Access <= 0.8.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-66061
Seriously Simple Podcasting <= 3.13.0 - Cross-Site Request Forgery
Medium
CVE-2025-12833
GeoDirectory – WP Business Directory Plugin and Classified Listings Directory <= 2.8.139 - Missing Authorization to Authenticated (Author+) Arbitrary Image Attachment
Medium
CVE-2025-66099
Chat Help <= 3.1.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.