Medium
CVE-2025-15475
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2026-0741
Electric Studio Download Counter <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings Parameters
Medium
CVE-2025-14846
SocialChamp with WordPress <= 1.3.5 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14173
Perfit WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Deletion
Medium
CVE-2026-0594
List Site Contributors <= 1.1.8 - Reflected Cross-Site Scripting via alpha
Critical
CVE-2025-14502
News and Blog Designer Bundle <= 1.1 - Unauthenticated Local File Inclusion
High
CVE-2025-15378
AJS Footnotes <= 1.0 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-15377
Sosh Share Buttons <= 1.1.0 - Cross-Site Request Forgery
High
CVE-2025-14615
DASHBOARD BUILDER <= 1.5.7 - Cross-Site Request Forgery to SQL Injection
High
CVE-2025-15283
Name Directory <= 1.30.3 - Unauthenticated Stored Cross-Site Scripting via Multiple Parameters
Critical
CVE-2025-14301
Integration Opvius AI for WooCommerce <= 1.3.0 - Unauthenticated Arbitrary File Deletion/Read via Path Traversal
High
CVE-2025-15266
GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-14613
GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute
Medium
CVE-2025-15021
Gotham Block Extra Light <= 1.5.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin Settings
Medium
CVE-2025-15020
Gotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode
Medium
CVE-2025-14389
WPBlogSyn <= 1.0 - Cross-Site Request Forgery to Arbitrary Remote Sync Configuration Update
Medium
CVE-2025-14880
Netcash WooCommerce Payment Gateway <= 4.1.3 - Missing Authorization to Unauthenticated Order Status Modification
Medium
CVE-2026-0678
Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter
Medium
CVE-2025-12178
SpiceForms Form Builder <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-14482
Crush.pics Image Optimizer <= 1.8.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update
Medium
CVE-2026-0680
Real Post Slider Lite <= 2.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via Settings
Medium
CVE-2025-13627
Makesweat <= 0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'makesweat_clubid' Setting
Medium
CVE-2025-14725
Internal Link Builder <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings
Medium
CVE-2026-0717
LottieFiles – Lottie block for Gutenberg <= 3.0.0 - Unauthenticated Sensitive Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.