Medium
CVE-2025-11863
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-12020
Double the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-12665
Ninja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion
Medium
CVE-2025-12631
Squirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-11821
Woocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-12813
Holiday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'
Medium
CVE-2025-12658
Preload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11882
Simple Donate <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12538
Fleet Manager <= 2.5.1 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-12590
YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-11532
Wisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Medium
CVE-2025-11822
WP Bootstrap Tabs <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-12632
RandomQuotr <= 1.0.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-11856
Eventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-12637
Elastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-11859
Paypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12651
Live Photos on WordPress <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-11170
WP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-11997
Document Pro Elementor – Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure
High
CVE-2025-12613
Cloudinary Node SDK is vulnerable to Arbitrary Argument Injection through parameters that include an ampersand
Medium
CVE-2025-67912
Stars Testimonials <= 3.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-49379
Custom Fields Account Registration For Woocommerce <= 1.2 - Authenticated (Author+) Privilege Escalation
Low
CVE-2025-12919
EverShop is vulnerable to Unauthorized Order Information Access (IDOR)
Low
CVE-2025-12918
Skuul School Management System has an Insecure Direct Object Reference (IDOR) Vulnerability in View Fee Invoice
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.