Medium
CVE-2025-12189
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Medium
CVE-2025-12163
Omnipress <= 1.6.5 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-13528
Feedback Modal for Website <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Feedback Data Exfiltration via 'export_data' Parameter
Medium
CVE-2025-13360
Quantic Social Image Hover <= 1.0.8 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-12191
PDF Catalog for WooCommerce <= 1.1.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-12128
Hide Categories Or Products On Shop Page <= 1.0.7 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2025-13006
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Unauthenticated Information Exposure
Medium
CVE-2025-12417
SurveyFunnel – Survey Plugin for WordPress <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-13494
SSP Debug <= 1.0.0 - Unauthenticated Sensitive Information Exposure
Critical
CVE-2025-13313
CRM Memberships <= 2.6 - Missing Authorization to Privilege Escalation via Unauthenticated Password Reset in 'ntzcrm_changepassword' AJAX Endpoint
Medium
CVE-2025-13312
CRM Memberships <= 2.6 - Missing Authorization to Unauthenticated 'ntzcrm_add_new_tag' AJAX Action
Medium
CVE-2025-13362
Norby AI <= 1.0.3 - Cross-Site Request Forgery to Settings Update
High
CVE-2025-65346
alexusmai laravel-file-manager is vulnerable to Directory Traversal via the unzip/extraction functionality
High
CVE-2025-13066
Demo Importer Plus <= 2.0.6 - Authenticated (Author+) Arbitrary File Upload via WXR Upload Bypass
Medium
CVE-2025-11759
Backup, Restore and Migrate your sites with XCloner <= 4.8.2 - Cross-Site Request Forgery in Xcloner_Remote_Storage:save()
Medium
CVE-2025-12804
Booking Calendar <= 10.14.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via bookingcalendar Shortcode
High
CVE-2025-13543
PostGallery <= 1.12.5 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-63009
Google Analytics Events <= 2.8.2 - Unauthenticated Information Exposure
Medium
CVE-2025-63077
Happy Addons for Elementor <= 3.20.3 - Missing Authorization
Medium
CVE-2025-62733
Custom Sidebars by ProteusThemes <= 1.0.3 - Cross-Site Request Forgery
Medium
CVE-2025-62736
Image Cleanup <= 1.9.2 - Missing Authorization
Medium
CVE-2025-67570
WPForms Google Sheet Connector <= 4.0.0 - Missing Authorization
Medium
CVE-2025-67569
AdForest <= 6.0.11 - Missing Authorization
Medium
CVE-2025-62735
User Spam Remover <= 1.1 - Unauthenticated Information Exposure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.