Medium
CVE-2025-12042
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-12064
WP2Social Auto Publish <= 2.4.7 - Reflected Cross-Site Scripting via PostMessage
High
CVE-2025-12099
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.3.8 - Authenticated (Administrator+) PHP Object Injection via 'import_all_courses'
High
CVE-2025-9334
Better Find and Replace <= 1.7.7 - Authenticated (Subscriber+) Limited Code Injection
Medium
CVE-2025-12177
Download Manager <= 3.3.30 - Unauthenticated Cron Trigger due to Hardcoded Cron Key
Medium
CVE-2025-12167
Contact Form 7 AWeber Extension <= 0.1.42 - Missing Authorization to Authenticated (Subscriber+) Log Reset
Medium
CVE-2025-66056
Uncanny Automator < 6.10.0 - Authenticated (Subscriber+) Information Exposure
Low
CVE-2025-64326
Weblate leaks the IP of project member inviting user to be reviewer in Audit log
Medium
CVE-2025-12527
Page & Post Notes <= 1.3.4 - Missing Authorization to Authenticated (Subscriber+) Note Update/Deletion
Critical
CVE-2025-12352
Gravity Forms <= 2.9.20 - Unauthenticated Arbitrary File Upload via 'copy_post_image'
Medium
CVE-2025-4522
IDonate 2.0.0 - 2.1.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Deletion via admin_post_donor_delete Function
High
CVE-2025-4519
IDonate 2.1.5 - 2.1.9 - Missing Authorization to Authenticated (Subscriber+) Account Takeover/Privilege Escalation via idonate_donor_password Function
High
CVE-2025-5483
LC Wizard 1.2.10 - 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation
Medium
CVE-2025-67536
LearnPress <= 4.2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64635
Feeds for YouTube <= 2.4.0 - Missing Authorization
Medium
CVE-2025-64355
JetElements For Elementor <= 2.7.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-63006
EventPrime <= 4.2.4.1 - Missing Authorization
Medium
CVE-2025-63007
EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-12520
WP Airbnb Review Slider <= 4.2 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-64373
Traveler < 3.2.6 - Unauthenticated Local File Inclusion
Medium
CVE-2025-63039
ListingPro <= 2.9.9 - Missing Authorization
High
CVE-2025-64430
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
Medium
CVE-2025-11268
Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-12360
Better Find and Replace <= 1.7.7 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.