Medium
CVE-2025-8464
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Low
CVE-2025-55285
Template Secret leakage in logs in Scaffolder when using `fetch:template`
Medium
CVE-2025-8089
Advanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8896
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-55207
@astrojs/node's trailing slash handling causes open redirect issue
High
CVE-2024-12612
School Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection
High
CVE-2025-6079
School Management System <= 93.2.0 - Authenticated (Student+) Arbitrary File Upload
High
CVE-2025-3671
WPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update
High
CVE-2025-6080
WPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation
Medium
CVE-2025-8293
Intl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter
Medium
CVE-2025-7439
Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link
Medium
CVE-2025-7440
Anber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link
Medium
CVE-2025-7668
Linux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-7651
Earnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-6221
Embed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter
Medium
CVE-2025-7649
Surbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7684
Last.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-7683
LatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-7664
Al Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function
Medium
CVE-2025-7686
weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Critical
CVE-2025-7441
StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-8898
Taxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2025-8143
Soledad <= 8.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pcsml_smartlists_h'
High
CVE-2025-49915
SMS Alert Order Notifications <= 3.8.5 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.