Medium
CVE-2025-58984
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,687
Medium
CVE-2025-58990
ShopLentor <= 3.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58997
Mow <= 4.10 - Cross-Site Request Forgery
Medium
CVE-2025-58987
Football Pool <= 2.12.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58980
Export WP Page to Static HTML/CSS <= 4.1.0 - Missing Authorization
Medium
CVE-2025-58982
Pixeline's Email Protector <= 1.3.8 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-10001
Import any XML, CSV or Excel File to WordPress <= 3.9.3 - Authenticated (Admin+) Limited Unsafe File Upload
Medium
CVE-2025-58993
Tutor LMS <= 3.7.4 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-49398
Easy Appointments <= 3.12.14 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-58981
Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization
Medium
CVE-2025-58975
Advanced Settings <= 3.1.1 - Cross-Site Request Forgery
Medium
CVE-2025-58978
PDF Generator for WordPress <= 1.5.4 - Missing Authorization
Medium
CVE-2025-8388
PowerPack Lite for Elementor <= 2.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting Via 'cursor_url'
Medium
CVE-2025-58989
Dynamic Text Field For Contact Form 7 <= 2.0.22 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58977
WP eBay Product Feeds <= 3.4.8 - Authenticated (Contributor+) Server Side Request Forgery
Medium
CVE-2025-58983
Include Me <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-58979
BerqWP <= 2.2.53 - Missing Authorization
Medium
CVE-2025-58985
Additional Custom Product Tabs for WooCommerce <= 1.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-58976
Accessibility Checker by Equalize Digital <= 1.31.0 - Missing Authorization
High
CVE-2025-58444
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
High
CVE-2025-58365
XWiki Blog Application: Privilege Escalation (PR) from account through blog content
Critical
CVE-2025-10690
Goza - Nonprofit Charity WordPress Theme <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation
Critical
CVE-2025-54994
@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API
Critical
CVE-2025-57285
CodeceptJS's incomprehensive sanitation can lead to Command Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.