Medium
CVE-2025-11373
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-12388
B Carousel Block – Responsive Image and Content Carousel <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2025-12139
File Manager for Google Drive – Integrate Google Drive with WordPress <= 1.5.3 - Unauthenticated Sensitive Information Exposure
High
CVE-2025-12384
Document Embedder – Embed PDFs, Word, Excel, and Other Files <= 2.0.0 - Missing Authorization to Unauthenticated Document Manipulation
Medium
CVE-2025-11917
WPeMatico RSS Feed Fetcher <= 2.8.11 - Authenticated (Subscriber+) Server-Side Request Forgery via wpematico_test_feed
Critical
CVE-2025-11749
AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation
High
CVE-2025-12197
The Events Calendar 6.15.1.1 - 6.15.9 - Unauthenticated SQL Injection via s
Medium
CVE-2025-11162
Spectra <= 2.19.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom CSS
Low
ghsa-j2pc-v64r-mv4f
Protobuf Maven Plugin protocDigest is ignored when using protoc from PATH
Medium
CVE-2025-11835
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.16.4 - Missing Authorization to Unauthenticated Arbitrary Member Subscription Auto Renewal
Medium
CVE-2025-12580
SMS for WordPress <= 1.1.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-12582
Features <= 0.0.2 - Missing Authorization to Authenticated (Subscriber+) Option Reset
Medium
CVE-2025-8871
Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
Medium
CVE-2025-64228
SUMO Affiliates Pro <= 11.0.0 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-64275
Booking Manager <= 2.1.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49913
CoSchedule <= 3.4.0 - Missing Authorization
Critical
CVE-2025-12674
KiotViet Sync <= 1.8.5 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-62106
WP-CRM System <= 3.4.5 - Missing Authorization
Medium
CVE-2025-49903
ZoloBlocks <= 2.3.11 - Missing Authorization
Medium
CVE-2025-64365
Ohio Extra <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-12677
KiotViet Sync <= 1.8.5 - Unauthenticated Webhook Key Exposure
Medium
CVE-2025-64220
Rey Core <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64174
OpenMage vulnerable to XSS in Admin Notifications
Medium
CVE-2025-62520
MantisBT unauthorized disclosure of private project column configuration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.