Critical
CVE-2025-30901
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 4,498
Reset filters
High
CVE-2025-30846
Restaurant Menu by MotoPress <= 2.4.4 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-30785
Subscribe to Download Lite <= 1.2.9 - Authenticated (Contributor+) Local File Inclusion
Critical
CVE-2025-30910
CM Download Manager <= 2.9.6 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-30831
Themify Event Post <= 1.3.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-30914
Metform <= 3.9.2 - Authenticated (Admin+) Server-Side Request Forgery
High
CVE-2025-30911
RomethemeKit For Elementor <= 1.5.4 - Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
High
CVE-2025-30890
Login Widget for Ultimate Member <= 1.1.2 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-30895
WpEvently <= 4.2.9 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-2328
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-1912
Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Low
CVE-2025-1911
Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
Medium
CVE-2025-1769
Product Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Medium
CVE-2024-13411
Zapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function
Medium
CVE-2025-1310
Jobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read
High
CVE-2025-2007
Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-2257
Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid <= 1.16.10 - Authenticated (Admin+) Command Injection
Medium
CVE-2025-2109
WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function
High
CVE-2025-2319
EZ SQL Reports Shortcode Widget and DB Backup 4.11.13 - 5.25.08 - Cross-Site Request Forgery to Remote Code Execution
High
CVE-2025-28893
Visual Text Editor <= 1.2.1 - Authenticated (Contributor+) Remote Code Execution
Critical
CVE-2025-28916
Docpro <= 2.0.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-1973
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
Low
CVE-2025-1972
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
High
CVE-2025-1970
Export and Import Users and Customers <= 2.6.2 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.