Critical
CVE-2025-46572
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Critical
CVE-2025-4104
Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Function
Medium
CVE-2025-2901
HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store
Medium
CVE-2025-4171
WZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-4388
Liferay Portal Reflected XSS in marketplace-app-manager-web
Medium
ghsa-jqx4-9gpq-rppm
@misskey-dev/summaly allows IP Filter Bypass via Redirect
Medium
CVE-2025-46736
Umbraco Makes User Enumeration Feasible Based on Timing of Login Response
Medium
CVE-2025-3766
Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelisting
High
CVE-2025-46814
FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injection vulnerability has been identified in ve
Medium
CVE-2025-4054
Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights
High
CVE-2025-3852
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Medium
CVE-2025-4220
Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-3860
CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameter
Medium
CVE-2025-4055
Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcode
High
CVE-2025-4335
Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalation
Critical
CVE-2025-3844
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover
Medium
CVE-2025-3924
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email Enumeration
High
CVE-2025-3921
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req Function
Medium
CVE-2025-3851
Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposure
Medium
CVE-2025-2821
Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modification
High
CVE-2025-46762
Apache Parquet Java: Potential malicious code execution from trusted packages in the parquet-avro module when reading an Avro schema from a Parquet file metadata
High
CVE-2025-0853
PGS Core <= 5.8.0 - Unauthenticated SQL Injection
High
CVE-2025-0856
PGS Core <= 5.8.0 - Missing Authorization via Multiple Functions
Medium
CVE-2024-12120
Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.