High
CVE-2025-12957
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-14384
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.9.2 - Missing Authorization to Authenticated (Contributor+) AI Access Token and Credit Disclosure
Medium
CVE-2025-14982
Booking Calendar <= 10.14.11 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2025-15370
Shield Security <= 21.0.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Disable Google Authenticator
Medium
CVE-2025-12641
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.6 - Missing Authorization to Unauthenticated Role Demotion
High
CVE-2025-13062
Supreme Modules Lite <= 2.5.62 - Authenticated (Author+) Arbitrary File Upload via JSON Upload Bypass
Medium
CVE-2025-12895
Kalium <= 3.29 - Missing Authorization to Unauthenticated Mail Relay via kalium_vc_contact_form_request
Medium
CVE-2025-13859
AffiliateX 1.0.0 - 1.3.9.3 - Authenticated (Subscriber+) Missing Authorization to Stored Cross-Site Scripting via save_customization_settings
Critical
CVE-2025-68001
g-FFL Checkout <= 2.1.0 - Unauthenticated Arbitrary File Upload
Medium
CVE-2026-22334
Woocommerce Book Price <= 1.3 - Authenticated (Subscriber++) Arbitrary File Download
Medium
CVE-2026-24594
Livemesh Addons for WPBakery Page Builder <= 3.9.4 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2026-24598
Multilanguage by BestWebSoft <= 1.5.2 - Missing Authorization
Medium
CVE-2026-40722
Yoast SEO Premium <= 26.6 - Missing Authorization
Medium
CVE-2025-69102
Test Email <= 1.1.7 - Reflected Cross-Site Scripting
High
CVE-2025-67938
Biagiotti < 3.5.2 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27042
NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar <= 3.2.1 - Missing Authorization
Medium
CVE-2026-24388
WPMasterToolKit <= 2.14.0 - Missing Authorization
High
CVE-2025-69099
North <= 5.7.5 - Authenticated (Contributor+) PHP Object Injection
Medium
CVE-2026-24361
LearnPress – Course Review <= 4.1.9 - Authenticated (Learnpress student+) Stored Cross-Site Scripting
High
CVE-2025-68898
Synergy Project Manager <= 1.5 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-0913
User Submitted Posts <= 20260110 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'usp_access' Shortcode
High
CVE-2025-68041
Omnichannel for WooCommerce <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2026-24595
Zoho CRM Lead Magnet <= 1.8.1.9 - Missing Authorization
Medium
CVE-2026-25472
Avada (Fusion) Builder <= 3.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.