Medium
CVE-2025-67956
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2025-67955
MyHome Core <= 4.1.0 - Unauthenticated Local File Inclusion
Critical
CVE-2025-15521
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
High
CVE-2026-0726
Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'
Medium
CVE-2026-0554
NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset
High
CVE-2025-15347
Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
High
CVE-2025-67945
MailerLite – WooCommerce integration <= 3.1.2 - Unauthenticated SQL Injection
Medium
CVE-2026-24579
Ai Image Alt Text Generator for WP <= 1.1.9 - Missing Authorization
High
CVE-2025-67946
AdForest <= 6.0.11 - Unauthenticated Local File Inclusion
Critical
CVE-2025-14533
Advanced Custom Fields: Extended <= 0.9.2.1 - Unauthenticated Privilege Escalation via Insert User Form Action
Medium
CVE-2025-14348
weMail <= 2.0.7 - Insufficient Authorization via x-wemail-user Header to Sensitive Information Disclosure
High
CVE-2025-14977
Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy <= 4.2.4 - Insecure Direct Object Reference to PayPal Account Takeover and Sensitive Information Disclosure
Medium
CVE-2026-1051
Newsletter – Send awesome emails from WordPress <= 9.1.0 - Cross-Site Request Forgery to Newsletter Unsubscription
High
CVE-2025-69314
Werkstatt < 4.8.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-69300
Premium Addons for Elementor <= 4.11.63 - Missing Authorization to Authenticated (Subscriber+) Settings Update
Medium
CVE-2025-14078
PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation
Medium
CVE-2025-13725
Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter
Medium
CVE-2025-14463
Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation
Medium
CVE-2026-0820
RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders
Medium
CVE-2025-14632
Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload
Medium
CVE-2025-12002
Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal
Medium
CVE-2025-14075
WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
Medium
CVE-2025-12718
Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay
High
CVE-2025-15491
Post Slides <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.