Medium
CVE-2025-8588
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-10694
User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.8.0 - Missing Authorization to Information Disclosure
Low
CVE-2025-11244
Password Protected <= 2.7.11 - Unauthenticated Authorization Bypass via IP Address Spoofing
High
CVE-2025-11238
Watu Quiz <= 3.4.4 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer
Medium
CVE-2025-11564
Tutor LMS – eLearning and online course solution <= 3.8.3 - Missing Authorization to Unauthenticated Payment Status Update
Medium
CVE-2025-12005
WP VR – 360 Panorama and Free Virtual Tour Builder For WordPress <= 8.5.41 - Improper Authorization to Authenticated (Contributor+) Plugin Settings Update
Medium
CVE-2025-11823
ShopLentor – WooCommerce Builder for Elementor & Gutenberg +21 Modules – All in One Solution <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-10579
BackWPup 5 - 5.5.0 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-11760
eRoom – Webinar & Meeting Plugin for Zoom, Google Meet, Microsoft Teams <= 1.5.6 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-62254
Liferay Portal ComboServlet denial of service via large file combination
Medium
CVE-2025-11875
SpendeOnline.org <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11897
The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
High
CVE-2025-8416
Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection
Medium
CVE-2025-62988
Slider Templates <= 1.0.3 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2025-4203
wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
Medium
CVE-2025-49907
MDTF <= 1.3.3.9 - Missing Authorization
Medium
CVE-2025-62100
ThemeRain Core <= 1.1.9 - Missing Authorization
Medium
CVE-2025-8483
Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
High
CVE-2025-12095
Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval
Medium
CVE-2025-64229
Client Invoicing by Sprout Invoices <= 20.8.7 - Missing Authorization
Medium
CVE-2025-10580
Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
CVE-2025-11888
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update
Medium
CVE-2025-10737
Open Source Genesis Framework <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2025-10723
PixelYourSite – Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.