Medium
CVE-2025-62094
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-32545
WooCommerce Products without featured images <= 0.1 - Cross-Site Request Forgery
Critical
CVE-2025-32660
JS Job Manager <= 2.0.2 - Unauthenticated Arbitrary File Upload
High
CVE-2025-32657
Testimonial Slider And Showcase Pro <= 2.1.7 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2025-3583
Newsletter <= 8.7.0 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-32636
Local Magic <= 2.6.0 - Unauthenticated SQL Injection
High
CVE-2025-26892
Celestial Aura <= 2.2 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-32561
WP_DEBUG Toggle <= 1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-32513
Nomupay Payment Processing Gateway <= 7.1.6 - Reflected Cross-Site Scripting
High
ghsa-f87w-3j5w-v58p
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
Critical
CVE-2025-32428
TigerVNC accessible via the network and not just via a UNIX socket as intended
Medium
CVE-2025-32426
Formie has XSS vulnerability for email notification content for preview
Medium
CVE-2025-32427
Formie has XSS vulnerability for importing forms
Medium
CVE-2025-3292
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Password Update
Medium
CVE-2025-2841
Cart66 Cloud <= 2.3.7 - Unauthenticated Information Exposure
Medium
CVE-2025-2881
Developer Toolbar <= 1.0.3 - Unauthenticated Information Exposure
Medium
CVE-2025-32395
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Medium
CVE-2025-32027
Yii does not prevent XSS in scenarios where fallback error renderer is used
Medium
CVE-2025-26746
Advanced Custom Fields: Link Picker Field <= 1.2.8 - Reflected Cross-Site Scripting
Medium
CVE-2025-26906
WP Delete User Accounts <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13338
Webcraftic Clearfy – WordPress optimization plugin <= 2.3.1 - Cross-Site Request Forgery to Clear Cache
Medium
CVE-2025-26749
Additional Custom Product Tabs for WooCommerce <= 1.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-3276
SKT Blocks – Gutenberg based Page Builder <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13337
Webcraftic Clearfy – WordPress optimization plugin <= 2.3.2 - Cross-Site Request Forgery to Plugin Settings Update via 'setup-wbcr_clearfy'
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.