Medium
CVE-2025-13001
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-12788
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Missing Payment Verification to Unauthenticated Payment Bypass
Medium
CVE-2025-12953
Classified Listing – AI-Powered Classified ads & Business Directory Plugin <= 5.2.0 - Missing Authorization to Authenticated (Subscriber+) Listing Types Tampering
Critical
CVE-2025-12539
TNC Toolbox: Web Performance <= 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover
Medium
CVE-2025-12787
Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation
High
CVE-2025-12846
Blocksy Companion <= 2.1.19 - Authenticated (Author+) Arbitrary File Upload via SVG Upload Bypass
An arbitrary file upload vulnerability in the Blocksy Companion plugin for WordPress allows authenticated attackers with author-level permissions or higher to upload arbitrary files, potentially leading to remote code execution.
Low
CVE-2025-62780
changedetection.io: Stored XSS in Watch update via API
High
CVE-2025-64519
TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topic_id parameter
High
CVE-2025-64518
CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection
Medium
CVE-2025-12880
Progress Bar Blocks for Gutenberg <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Medium
CVE-2025-12652
Ungapped Widgets <= 1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11129
Include fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'api' and 'type'
Medium
CVE-2025-12672
Flickr Show <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11874
Slippy Slider – Responsive Touch Navigation Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12671
WP-Iconics <= 0.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11829
Five9 Live Chat <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12667
GitHub Gist Shortcode Plugin <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12010
Authors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode
Medium
CVE-2025-12588
USB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12644
Nonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields
High
CVE-2025-11451
Auto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read
Medium
CVE-2025-12019
Featured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-11873
WP BBCode <= 1.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12754
Geopost <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.