Medium
CVE-2025-68862
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2026-25329
Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker <= 10.3.4 - Missing Authorization
High
CVE-2025-69377
User Extra Fields <= 17.0 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-67990
GMap Targeting <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-68026
LC Wizard <= 2.1.1 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-68028
GA4WP: Google Analytics for WordPress <= 2.10.0 - Missing Authorization
High
CVE-2025-69378
Product Filter for WooCommerce <= 9.1.2 - Authenticated (Shop Manager+) Privilege Escalation
High
CVE-2025-69374
Eleblog – Elementor Blog And Magazine Addons <= 2.0.3 - Unauthenticated Local File Inclusion
Medium
CVE-2025-14079
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.5 - Missing Authorization to Authenticated (Subscriber+) Settings Update
High
CVE-2026-1294
All In One Image Viewer Block <= 1.0.2 - Unauthenticated Server-Side Request Forgery via image-proxy Endpoint
Medium
CVE-2026-1271
ProfileGrid <= 5.9.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Profile and Cover Image Modification
Medium
CVE-2026-1654
Peter's Date Countdown <= 2.0.0 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Medium
CVE-2025-13416
ProfileGrid – User Profiles, Groups and Communities <= 5.9.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Suspension
Medium
CVE-2026-1319
Robin Image Optimizer <= 2.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Image Alternative Text Field
Medium
CVE-2026-1268
Dynamic Widget Content <= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field
Medium
CVE-2026-0867
Essential Widgets <= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2026-1246
ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
High
CVE-2025-13192
Popup builder with Gamification <= 2.2.0 - Unauthenticated SQL Injection via Multiple REST API Endpoints
Medium
CVE-2025-68834
Sync Master Sheet – Product Sync with Google Sheet for WooCommerce <= 1.1.3 - Missing Authorization
Medium
CVE-2025-68024
Addonify – WooCommerce Wishlist <= 2.0.15 - Missing Authorization to Unauthenticated Settings Update
High
CVE-2025-67982
Urna <= 2.5.12 - Unauthenticated Local File Inclusion
High
CVE-2025-68841
TopperPack – Complete Elementor Addons, Theme & CPT Builder <= 1.2.1 - Unauthenticated Local File Inclusion
Medium
CVE-2025-68022
Plugin BlueX for WooCommerce <= 3.1.4 - Missing Authorization
Medium
CVE-2025-68023
Addonify – Compare Products For WooCommerce <= 1.1.17 - Missing Authorization to Unauthenticated Settings Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.