High
CVE-2025-12099
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
Medium
CVE-2025-8871
Everest Forms (Pro) <= 1.9.7 - Unauthenticated PHP Object Injection via PHAR Deserialization in Form Signature
Medium
CVE-2025-67535
Maps <= 4.8.6 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-64206
Jannah <= 7.6.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-11881
AppPresser – Mobile App Framework <= 4.5.0 - Missing Authorization to Unauthenticated Limited Sensitive Information Exposure
High
CVE-2025-64353
Polylang <= 3.7.3 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-12016
qnotsquiz <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-10861
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.4 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-8427
Beaver Builder Plugin (Starter Version) <= 2.9.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'auto_play'
Medium
CVE-2025-11810
Print Button Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-11834
WP AD Gallery <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-48086
Ajax Search Lite <= 4.13.3 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-64233
Codiqa < 1.2.8 - Unauthenticated PHP Object Injection
High
CVE-2025-11691
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection
An unauthenticated SQL injection vulnerability in PPOM for WooCommerce allows attackers to extract sensitive database information when Legacy Price Calculations are enabled.
Critical
CVE-2025-11391
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
A vulnerability in PPOM – Product Addons & Custom Fields for WooCommerce allows unauthenticated attackers to upload arbitrary files via the image cropper, potentially enabling remote code execution on sites with the paid version active.
High
CVE-2025-11517
Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass
High
CVE-2025-62008
Product Table For WooCommerce <= 1.2.4 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2025-10682
TARIFFUXX <= 1.4 - Authenticated (Contributor+) SQL Injection via tariffuxx_configurator Shortcode
High
CVE-2025-62035
Togo < 1.0.4 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-8593
GSheetConnector For Gravity Forms <= 1.3.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation
High
CVE-2025-60039
Noisa <= 2.6.0 - Unauthenticated PHP Object Injection
High
CVE-2025-10862
Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers <= 2.1.3 - Unauthenticated SQL Injection via 'id'
High
CVE-2025-58952
Neuronet < 1.14.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-62931
MSN Partner Hub <= 2.8.7 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.