Medium
CVE-2025-11707
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,631
Medium
CVE-2025-11970
Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated <= 1.0.9 - Authenticated (Admin+) Server-Side Request Forgery
Medium
CVE-2025-12076
Social Media Auto Publish <= 3.6.5 - Reflected Cross-Site Scripting via PostMessage
High
CVE-2025-13089
WP Directory Kit <= 1.4.7 - Unauthenticated SQL Injection
Medium
CVE-2025-14477
404 Solution <= 3.1.0 - Authenticated (Admin+) SQL Injection via 'filterText' Parameter
Medium
CVE-2025-14278
HT Slider for Elementor <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-14050
Design Import/Export <= 2.2 - Authenticated (Administrator+) SQL Injection via XML File Import
Medium
CVE-2025-14581
HAPPY – Helpdesk Support Ticket System <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Ticket Reply
Medium
CVE-2025-13403
Employee Spotlight – Team Member Showcase & Meet the Team Plugin <= 5.1.3 - Missing Authorization to Authenticated (Subscriber+) Tracking Opt-In/Opt-Out Modification
Medium
CVE-2025-14454
Image Slider by Ays- Responsive Slider and Carousel <= 2.7.0 - Cross-Site Request Forgery to Arbitrary Slider Deletion
Medium
CVE-2025-12512
GenerateBlocks <= 2.1.2 - Authenticated (Contributor+) Information Exposure via Metadata
High
CVE-2025-26866
Apache HugeGraph-Server: RAFT and deserialization vulnerability
High
CVE-2025-67726
Tornado: Quadratic DoS via Crafted Multipart Parameters
Medium
CVE-2025-67724
Tornado vulnerable to Header Injection and XSS via reason argument
High
CVE-2025-67725
Tornado: Quadratic DoS via Repeated Header Coalescing
High
CVE-2024-58303
FoF Pretty Mail has a server-side template injection vulnerability
Medium
CVE-2025-10289
Filter & Grids <= 3.2.0 - Unauthenticated SQL Injection
Medium
CVE-2025-66125
Ultimate Auction <= 4.3.3 - Unauthenticated Information Exposure
Medium
f33bcc8d-3d21-4de8-87ac-a5e334bb641d
WPGraphQL Smart Cache < 2.0.1 - Unauthenticated Private Content Disclosure
Medium
CVE-2025-8780
Livemesh SiteOrigin Widgets <= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Hero Header and Pricing Table Widgets
Medium
CVE-2025-9488
Redux Framework <= 4.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via data Parameter
Medium
CVE-2025-8195
JetWidgets For Elementor <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Comparison and Subscribe Widgets
High
CVE-2025-14072
Ninja Forms <= 3.13.2 - Missing Authorization to Unauthenticated Submission Disclosure
Medium
CVE-2025-14056
Custom Post Type UI <= 1.18.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'label' Import Parameter
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.