Medium
CVE-2025-4205
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,728
Medium
CVE-2025-4671
Profile Builder <= 3.13.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via user_meta and compare Shortcodes
High
CVE-2025-4392
Shared Files <= 1.7.48 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function
Medium
CVE-2025-4420
Vayu Blocks <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via containerWidth Parameter
Medium
CVE-2025-1725
Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress <= 6.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Uploads
Medium
CVE-2025-5116
WP Plugin Info Card <= 5.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via containerid Parameter
Medium
CVE-2025-5103
Ultimate Gift Cards for WooCommerce <= 3.1.4 - Authenticated (Administrator+) SQL Injection via wps_wgm_save_post Function
Medium
CVE-2024-8008
WSO2 products vulnerable to Cross-site Scripting
Medium
CVE-2024-1440
WSO2 is vulnerable to Open Redirect through multi-option URL in its authentication endpoint
Critical
CVE-2025-4797
Golo <= 1.7.0 - Authentication Bypass to Account Takeover
Medium
CVE-2025-4047
Broken Link Checker <= 2.4.4 - Missing Autorization to Authenticated (Subscriber+) Plugin Status Dashboard View
Critical
CVE-2025-1750
LlamaIndex DuckDBVectorStore vulnerable to SQL injection through ref_doc_id
Medium
CVE-2025-3919
WordPress Comments Import & Export <= 2.4.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Critical
Exploited in attacks
CVE-2025-49113
Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization
Medium
CVE-2025-5420
juzaweb CMS allows cross-site scripting by uploading an SVG file
Medium
CVE-2025-48133
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.4.0.2 - Missing Authorization
High
CVE-2025-49072
Mr. Murphy - Custom Dress Tailoring Clothing WordPress Theme < 1.2.12.1 - Unauthenticated PHP Object Injection
High
CVE-2025-4224
wpForo + wpForo Advanced Attachments <= 3.1.3 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-49069
Contact Forms by Cimatti Plugin <= 1.9.8 - Cross-Site Request Forgery
Medium
CVE-2025-49068
Ocean Extra <= 2.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-2939
Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated PHP Object Injection to Limited Remote Code Execution
Medium
CVE-2018-25111
django-helpdesk before 1.0.0 allows Sensitive Data Exposure because of os.umask(0) in models.py.
Medium
CVE-2025-5034
WP File Download <= 6.2.5 - Reflected Cross-Site Scripting
Medium
CVE-2025-4691
Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.21 - Insecure Direct Object Reference to Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.