Medium
CVE-2025-62254
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-11875
SpendeOnline.org <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-11897
The7 — Ultimate WordPress & WooCommerce Theme <= 12.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'the7_fancy_title_css'
High
CVE-2025-8416
Product Filter by WBW <= 2.9.7 - Unauthenticated SQL Injection
Medium
CVE-2025-62988
Slider Templates <= 1.0.3 - Authenticated (Subscriber+) Server-Side Request Forgery
High
CVE-2025-4203
wpForo Forum <= 2.4.8 - Unauthenticated SQL Injection via get_members Function
Medium
CVE-2025-49907
MDTF <= 1.3.3.9 - Missing Authorization
Medium
CVE-2025-62100
ThemeRain Core <= 1.1.9 - Missing Authorization
Medium
CVE-2025-8483
Discussion Board – WordPress Forum Plugin <= 2.5.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
High
CVE-2025-12095
Simple Registration for WooCommerce <= 1.5.8 - Cross-Site Request Forgery to Privilege Escalation via Role Request Approval
Medium
CVE-2025-64229
Client Invoicing by Sprout Invoices <= 20.8.7 - Missing Authorization
Medium
CVE-2025-10580
Widget Options – The #1 WordPress Widget & Block Control Plugin <= 4.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
CVE-2025-11888
ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution <= 4.8.4 - Incorrect Authorization to Authenticated (Editor+) License Status Update
Medium
CVE-2025-10737
Open Source Genesis Framework <= 3.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
Medium
CVE-2025-10723
PixelYourSite – Your smart PIXEL (TAG) Manager < 11.1.2 - Authenticated (Administrator+) Local File Inclusion
Medium
CVE-2025-11879
GenerateBlocks <= 2.1.1 - Improper Authorization to Authenticated (Contributor+) Arbitrary Options Disclosure
Medium
CVE-2025-10686
Creta Testimonial Showcase <= 1.2.3 - Authenticated (Editor+) Local File Inclusion
Medium
CVE-2025-11497
Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery to Settings Manipulation
Medium
CVE-2025-49906
WPComplete <= 2.9.5.3 - Missing Authorization
Medium
CVE-2025-67553
Advanced FAQ Manager <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
CVE-2025-62255
Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page
Medium
CVE-2025-60837
MCMS reflected cross-site scripting (XSS) vulnerability
Medium
CVE-2025-62517
rollbar vulnerable to Prototype Pollution in merge()
Medium
CVE-2025-10740
URL Shortener Plugin For WordPress <= 3.0.7 - Missing Authorization to Authenticated (Subscriber+) Link Manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.