Medium
CVE-2025-58979
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-58985
Additional Custom Product Tabs for WooCommerce <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58976
Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization
High
CVE-2025-58444
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
High
CVE-2025-58365
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Critical
CVE-2025-10690
Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Critical
CVE-2025-54994
@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API
Critical
CVE-2025-57285
CodeceptJS's incomprehensive sanitation can lead to Command Injection
High
CVE-2025-56265
N8N's Chat Trigger component is vulnerable to XSS
Medium
CVE-2025-10097
SimStudioAI: A function in route.ts is vulnerable to Code Injection
High
CVE-2025-9539
AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress <= 5.3.6 - Missing Authorization To Authenticated (Subscriber+) Remote Code Execution via Automation Creation
Medium
CVE-2025-9542
AutomatorWP <= 5.3.7 - Authenticated (Subscriber+) Missing Authorization to Multiple Functions
Medium
CVE-2025-9061
Wilmer Core <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-9058
Mikado Core <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-9489
WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
Medium
CVE-2019-25225
sanitize-html is vulnerable to XSS through incomprehensive sanitization
Medium
CVE-2025-58782
Apache Jackrabbit: Core and JCR Commons are vulnerable to Deserialization of Untrusted Data
Critical
CVE-2025-9114
Doccure <= 1.5.0 - Unauthenticated Arbitrary User Password Change
Critical
CVE-2025-9113
Doccure Core <= 1.5.3 - Unauthenticated Arbitrary File Upload
High
CVE-2025-9112
Doccure <= 1.5.0 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-59004
WC Return products <= 1.5 - Reflected Cross-Site Scripting
Medium
CVE-2024-5200
Postie <= 1.9.70 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-59005
Categorify <= 1.0.7.5 - Missing Authorization
Medium
CVE-2025-59008
ZIP Code Based Content Protection <= 1.0.0 - Authenticated (Administrator+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.