Medium
CVE-2025-0969
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,631
Medium
CVE-2025-8199
MarqueeAddons <= 2.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial Marquee Widget
Medium
CVE-2025-8687
Enter Addons <= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown and Image Comparison Widgets
Medium
CVE-2025-9856
Popup Builder – Create highly converting, mobile friendly marketing popups. <= 4.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-9207
TI WooCommerce Wishlist <= 2.10.0 - Unauthenticated HTML Injection
Medium
CVE-2025-8779
All-in-One Addons for Elementor – WidgetKit <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Team and Countdown Widgets
Critical
CVE-2025-10738
URL Shortener Plugin For WordPress <= 3.0.7 - Unauthenticated SQL Injection
High
CVE-2025-53960
Apache StreamPark: Use the user’s password as the secret key Vulnerability
Critical
CVE-2025-65854
MineAdmin has an insecure default password
High
ghsa-5j59-xgg2-r9c4
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
Medium
CVE-2025-12362
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7 - Missing Authorization to Unauthenticated Withdrawal Request Approval
Medium
ghsa-c6m7-q6pr-c64r
Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components
High
ghsa-cpqf-f22c-r95x
Vite Plugin React has a Denial of Service Vulnerability in React Server Components
High
CVE-2025-67779
Denial of Service Vulnerability in React Server Components
High
CVE-2025-13094
WP3D Model Import Viewer <= 1.0.7 - Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2025-14508
MediaCommander – Bring Folders to Media, Posts, and Pages <= 2.3.1 - Missing Authorization to Authenticated (Author+) Media Folder Deletion
Medium
CVE-2025-13705
Custom Frames <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'class' Shortcode Parameter
Medium
CVE-2025-14539
Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter
Medium
CVE-2025-14378
Quick Testimonials <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-13077
افزونه پیامک ووکامرس فوق حرفه ای (جدید) payamito sms woocommerce <= 1.3.5 - Unauthenticated Time-Based Blind SQL Injection
Medium
CVE-2025-14394
Popover Windows <= 1.2 - Cross-Site Request Forgery to Arbitrary Popover Configuration Update
Medium
CVE-2025-14395
Popover Windows <= 1.2 - Missing Authorization to Authenticated (Subscriber+) Popover Configuration Update via AJAX Actions
Medium
CVE-2025-14462
Lucky Draw Contests <= 4.2 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-14451
Solutions Ad Manager <= 1.0.0 - Unauthenticated Open Redirect via 'sam-redirect-to' Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.