Medium
CVE-2025-5844
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-8080
Alobaidi Captcha <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2025-8720
Plugin README Parser <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via target Parameter
Medium
CVE-2025-7507
elink – Embed Content <= 1.1.0 - Authenticated (Contributor+) Insufficient Input Validation
Medium
CVE-2025-8604
WP Table Builder – WordPress Table Plugin <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Critical
CVE-2025-6679
Contact Form by Bit Form - Bit Form <= 2.20.3 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-55672
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
CVE-2025-55674
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
CVE-2025-8680
B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-8676
B Slider - Gutenberg Slider Block for WP <= 2.0.0 - Authenticated (Subscriber+) Sensitive Information Exposure
High
CVE-2025-8342
WooCommerce OTP Login With Phone Number, OTP Verification <= 1.8.47 - Authentication Bypass
High
CVE-2025-6025
Order Tip for WooCommerce <= 1.5.4 - Unauthenticated Tip Manipulation to Negative Value Leading to Unauthorized Discounts
Critical
CVE-2025-8943
Flowise OS command remote code execution
Medium
CVE-2025-49910
WPGuppy <= 1.1.4 - Missing Authorization
Medium
CVE-2025-55708
Quiz And Survey Master <= 10.2.4 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-53581
RSS Feed Pro <= 1.1.8 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-52769
flexo-social-gallery <= 1.0006 - Cross-Site Request Forgery
Medium
CVE-2025-52765
NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross-Site Request Forgery
Medium
CVE-2025-54739
Nexter Blocks <= 4.5.4 - Missing Authorization
Medium
CVE-2025-54717
WP Membership <= 1.6.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2025-55714
JetElements For Elementor <= 2.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-55710
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.37.2 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-53249
Build App Online <= 1.0.23 - Cross-Site Request Forgery
Medium
CVE-2025-53341
Stratus <= 4.2.5 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.