Medium
CVE-2025-13972
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-14138
WPLG Default Mail From <= 1.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
High
CVE-2025-12824
Player Leaderboard 1.0.0 - 1.0.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-12834
Accept Stripe Payments Using Contact Form 7 <= 3.1 - Reflected Cross-Site Scripting via failure_message
Medium
CVE-2025-13884
Hide Email Address <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
High
CVE-2025-14044
Visitor Logic Lite <= 1.0.3 - Unauthenticated PHP Object Injection via 'lpblocks' Cookie
High
CVE-2025-13886
LT Unleashed <= 1.1.1 - Authenticated (Contributor+) Local File Inclusion via 'template' Parameter
Medium
CVE-2025-14293
WP Job Portal <= 2.4.0 - Authenticated (Subscriber+) Arbitrary File Read
Medium
CVE-2025-67520
Media Library Tools <= 1.6.15 - Authenticated (Author+) SQL Injection
Critical
CVE-2025-13764
WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation
High
CVE-2025-13339
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
Critical
CVE-2025-13613
Elated Membership <= 1.2 - Authentication Bypass via Social Login
Medium
CVE-2025-67962
Broken Link Checker <= 1.2.6 - Authenticated (Author+) SQL Injection
Medium
CVE-2025-13677
Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal
Medium
CVE-2025-13642
ProfilePress <= 4.16.7 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Medium
CVE-2025-62998
AI CoPilot <= 1.2.7 - Authenticated (Contributor+) Sensitive Information Exposure
Medium
CVE-2025-67578
Email Capture <= 3.12.4 - Missing Authorization
Medium
CVE-2025-67950
All In One SEO Pack <= 4.9.1 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-67469
PDF Thumbnail Generator <= 1.4 - Cross-Site Request Forgery
High
CVE-2025-13065
Starter Templates <= 4.4.41 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
Medium
CVE-2025-13748
Fluent Forms <= 6.1.7 - Unauthenticated Insecure Direct Object Reference to Payment Status Tampering via submission_id
Medium
CVE-2025-12577
Listar – Directory Listing & Classifieds WordPress Plugin <= 3.0.0 - Missing Authorization to Authenticated (Subscriber+) Listing Update
Medium
CVE-2025-12091
Search, Filters & Merchandising for WooCommerce <= 3.0.67 - Missing Authorization to Authenticated (Subscriber+) Plugin Deactivation
Medium
CVE-2025-13922
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection via ORDER BY Clause
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.