Medium
CVE-2025-12168
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-13725
Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter
Low
CVE-2026-0682
Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
Medium
CVE-2025-14463
Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation
Medium
CVE-2026-0820
RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders
Medium
CVE-2025-14632
Filr – Secure document library <= 1.2.11 - Authenticated (Administrator+) Stored Cross-Site Scripting via HTML Upload
Medium
CVE-2025-14450
Wallet System for WooCommerce <= 2.7.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Wallet Balance Manipulation
Medium
CVE-2025-12002
Feeds for YouTube Pro <= 2.6.0 - Unauthenticated Arbitrary File Read via Path Traversal
Medium
CVE-2025-14075
WP Hotel Booking <= 2.2.7 - Unauthenticated Sensitive Information Exposure via 'email' Parameter
Medium
CVE-2025-12718
Quick Contact Form <= 8.2.6 - Unauthenticated Open Mail Relay
Critical
CVE-2025-15403
RegistrationMagic <= 6.0.7.1 - Unauthenticated Privilege Escalation via admin_order
Medium
CVE-2026-24591
Turn Yoast SEO FAQ Block to Accordion <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-1087
The Guardian News Feed <= 1.2 - Cross-Site Request Forgery to Settings Update
High
CVE-2025-15491
Post Slides <= 1.0.1 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2026-24593
AWP Classifieds <= 4.4.3 - Unauthenticated Information Exposure
Medium
CVE-2025-68883
bidorbuy Store Integrator <= 2.12.0 - Reflected Cross-Site Scripting
High
CVE-2025-68017
Antideo Email Validator <= 1.0.10 - Unauthenticated SQL Injection
Medium
CVE-2026-25004
CM Business Directory – Optimise and showcase local business <= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-67939
Tickera <= 3.5.6.2 - Missing Authorization
Medium
CVE-2025-12825
User Registration Using Contact Form 7 <= 2.5 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2026-1096
Best-wp-google-map <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'latitude' Shortcode Attribute
High
CVE-2025-14478
Demo Importer Plus <= 2.0.9 - Authenticated (Author+) Blind XML External Entity Injection via SVG File Upload
High
CVE-2025-67941
The Aisle < 2.9.1 - Unauthenticated Local File Inclusion
Medium
CVE-2026-25003
Client Portal – Private user pages and login <= 1.2.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.