Medium
CVE-2025-12126
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-11999
Add Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-11860
Twitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11805
Skip to Timestamp <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11996
Find Unused Images <= 1.0.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion
Medium
CVE-2025-12021
WP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-12753
Chart Expert <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11894
Shelf Planner <= 2.8.1 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-11891
Shelf Planner <= 2.8.1 - Unauthenticated Information Exposure via Log Files
Medium
CVE-2025-12132
WP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12662
Coon Google Maps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11886
CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
Medium
CVE-2025-12526
Private Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset
High
CVE-2025-11521
Astra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-11869
Precise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12663
Jeba Cute forkit <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-11457
EasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-12668
WP Count Down Timer <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11986
Crypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State
Medium
CVE-2025-11988
Crypto Tool <= 2.22 - Missing Authentication to Unauthenticated Limited File Deletion
Medium
CVE-2025-12589
WP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-12711
Share to Google Classroom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google Shortcode
High
CVE-2025-11168
Mementor Core <= 2.2.5 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-11828
Magazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.