High
CVE-2025-12973
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-12747
Tainacan <= 1.0.0 - Unauthenticated Information Exposure
Medium
CVE-2025-12935
FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
Medium
CVE-2025-66104
Offload, AI & Optimize with Cloudflare Images <= 1.9.5 - Missing Authorization
Medium
CVE-2025-12778
Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-5092
Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
High
CVE-2025-12484
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-13035
Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains
Medium
CVE-2025-13085
SiteSEO – SEO Simplified <= 1.3.2 - Insecure Direct Object Reference to Sensitive Post Meta Disclosure
Medium
CVE-2025-12535
SureForms <= 1.13.1 - Cross-Site Request Forgery Protection Bypass via Improper Nonce Distribution
High
CVE-2025-13145
WP Import – Ultimate CSV XML Importer for WordPress <= 7.33.1 - Authenticated (Administrator+) PHP Object Injection via CSV Import
High
CVE-2026-15291
Chat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12842
Booking Plugin for WordPress Appointments – Time Slot <= 1.4.7 - Unauthenticated Arbitrary Email Sending
Medium
CVE-2025-12349
Email Subscribers & Newsletters <= 5.9.10 - Missing Authentication to Unauthenticated Mailing Queue Trigger
Medium
CVE-2025-12426
Quiz Maker <= 6.7.0.80 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12770
New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling
Medium
CVE-2025-12777
YITH WooCommerce Wishlist <= 4.10.0 - Unauthenticated Wishlist Token Disclosure to Wishlist Item Deletion
Medium
CVE-2025-8084
AI Engine <= 3.1.8 - Authenticated (Editor+) Server-Side Request Forgery
High
CVE-2025-13206
GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'
High
CVE-2025-13070
CSV to SortTable <= 4.2 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-12174
Directorist: AI-Powered Business Directory Plugin with Classified Ads Listings <= 8.5.2 - Missing Authorization to Authenticated (Subscriber+) Data Export and Slug Update
Medium
CVE-2025-11427
WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery
Medium
CVE-2025-12481
WP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure
High
CVE-2025-12955
Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.