Medium
CVE-2025-28941
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,631
Medium
CVE-2025-28929
Tabbed Login Widget <= 1.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-28907
WP Last Modified <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-28856
W3Counter Free Real-Time Web Stats <= 4.1 - Cross-Site Request Forgery
Medium
CVE-2025-28926
Post Read Time <= 1.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-28913
WP Add Active Class To Menu Item <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-28938
WP Performance Pack <= 2.5.3 - Missing Authorization
Medium
CVE-2025-2048
Lana Downloads Manager <= 1.9.0 - Authenticated (Admin+) Arbitrary File Download
Medium
CVE-2025-28896
AS English Admin <= 1.0.0 - Open Redirection
High
CVE-2025-28915
ThemeEgg ToolKit <= 1.2.9 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-28897
Domain Theme <= 1.3 - Cross-Site Request Forgery
Medium
CVE-2025-28900
TabGarb Pro <= 2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-28912
Custom Dashboard Page <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-28925
WATI Chat and Notification <= 1.1.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-28909
WP No-Bot Question <= 0.1.7 - Cross-Site Request Forgery
Medium
CVE-2025-28876
Skrill Official <= 1.0.66 - Cross-Site Request Forgery
Medium
CVE-2024-13838
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
Medium
CVE-2025-28878
Awesome Surveys <= 2.0.10 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-28872
Block Spam By Math Reloaded <= 2.2.4 - Missing Authorization
Medium
CVE-2025-28940
Back To Top <= 2.0 - Cross-Site Request Forgery
Medium
CVE-2025-26923
Event post <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-26566
In Stock Mailer for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2024-13430
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcode
Medium
CVE-2025-28905
Featured Posts Grid <= 1.7 - Cross-Site Request Forgery to Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.