Critical
CVE-2025-49422
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-8085
Ditty <= 3.1.57 - Unauthenticated Server-Side Request Forgery
High
CVE-2025-8218
Real Spaces - WordPress Properties Directory Theme <= 3.5 - Authenticated (Subscriber+) Privilege Escalation to Administrator via 'change_role_member'
Medium
CVE-2025-52752
IDonatePro <= 2.1.9 - Authenticated (Subscriber+) Information Exposure
High
CVE-2025-49890
Organic Beauty <= 1.4.6 - Unauthenticated PHP Object Injection
Medium
CVE-2025-49434
Laposta WooCommerce <= 1.9.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49889
Custom Comment <= 2.1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49436
Custom Menu <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49438
Simple Login Log <= 1.1.3 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-64230
Filr <= 1.2.10 - Authenticated (Contributor+) Arbitrary File Deletion
Medium
CVE-2025-52751
Slide Puzzle <= 1.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-49891
Contact Info Widget <= 2.6.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49892
Pending Order Bot <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Unrated
834
JS Jobs extension (v1.4.2)
Unrated
833
phoc commander
Low
CVE-2025-9092
Bouncy Castle for Java Uncontrolled Resource Consumption Vulnerability
High
CVE-2025-49895
ServerBuddy by PluginBuddy.com <= 1.0.5 - Cross-Site Request Forgery to PHP Object Injection
Medium
CVE-2025-49894
WP Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-15659
Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-49893
Elizaibots <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-15658
Emmet <= 0.3.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-52750
Emu2 <= 0.83b - Reflected Cross-Site Scripting
Medium
CVE-2025-8719
Translate This - Google Translate Web Element Shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter
Medium
CVE-2025-7499
BetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.