Medium
CVE-2025-46452
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-46498
Zalo Official Live Chat <= 1.0.0 - Cross-Site Request Forgery
Medium
CVE-2025-3743
Upsell Funnel Builder for WooCommerce <= 3.0.0 - Unauthenticated Order Manipulation
Medium
CVE-2025-46491
Multi-Column Taxonomy List <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46519
Media Library Downloader <= 1.3.1 - Missing Authorization
Medium
CVE-2025-46510
Contact Form 7 Calendar <= 3.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-46480
Nepali Post Date <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46511
BeerXML Shortcode <= 0.7.1 - Authenticated (Contributor+) Server-Side Request Forgery
Medium
CVE-2025-46461
RRSSB <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-2470
Service Finder Bookings <= 5.1 - Unauthenticated Privilege Escalation via 'nsl_registration_store_extra_input'
High
CVE-2025-2238
Vikinger <= 1.9.30 - Authenticated (Subscriber+) Privilege Escalation via 'vikinger_user_meta_update_ajax'
Medium
CVE-2025-46508
Advanced lazy load <= 1.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-46521
WS Force Login Page <= 3.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-46509
360 View <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46534
Image Style Hover <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46451
Floating Social Bar <= 1.1.7 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-3742
Responsive Lightbox & Gallery <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-3752
Able Player, accessible HTML5 media player <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via preload Parameter
Medium
CVE-2025-46477
WP Customize Login Page <= 1.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-46453
Zoho Creator Forms <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46449
WoWHead Tooltips <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-46523
COVID-19 (Coronavirus) Update Your Customers <= 1.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-46507
Unsafe Mimetypes <= 0.1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-46501
Mixcloud Embed <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.