Medium
CVE-2025-10720
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Medium
CVE-2025-10305
Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion
Medium
CVE-2025-10124
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.14 - Authenticated (Contributor+) Booking Deletion
Medium
CVE-2025-53424
WooCommerce Orders & Customers Exporter <= 5.4 - Missing Authorization
Medium
CVE-2025-53423
Triss <= 2.6 - Reflected Cross-Site Scripting
Medium
CVE-2025-58916
Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-10489
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
Medium
CVE-2025-10658
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
Medium
CVE-2025-10181
Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-59417
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages
High
CVE-2025-10647
Embed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2025-5948
Service Finder Bookings <= 6.0 - Unauthenticated Privilege Escalation via claim_business
Medium
CVE-2025-10146
Download Manager <= 3.3.23 - Reflected Cross-Site Scripting via `user_ids` Parameter
High
CVE-2025-5955
Service Finder SMS System <= 2.0.0 - Authentication Bypass
Medium
CVE-2025-8487
Kubio AI Page Builder <= 2.6.3 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation
Critical
CVE-2025-6237
InvokeAI has External Control of File Name or Path
Medium
CVE-2025-53422
WhatsApp Chat for WordPress and WooCommerce <= 1.2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-49938
JetEngine <= 3.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-10619
@sequa-ai/sequa-mcp has Command Injection vulnerability
Medium
CVE-2025-56648
Parcel has an Origin Validation Error vulnerability
Medium
CVE-2025-9992
Ghost Kit <= 3.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-8565
Privacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.4.3 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Installation
Low
CVE-2025-59414
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
Medium
CVE-2025-8419
Keycloak SMTP Inject Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.