Critical
CVE-2024-52416
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-67544
Shopkeeper Extender < 7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64259
Theater for WordPress <= 0.18.8 - Missing Authorization
Medium
CVE-2025-11769
WordPress Content Flipper <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-8397
Save as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode
Medium
CVE-2025-12015
Convert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect
Medium
CVE-2025-10295
Angel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-12620
Poll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` Parameter
Medium
CVE-2025-12891
Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-12366
Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference
Medium
CVE-2025-12536
SureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12892
Survey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update
High
CVE-2025-11923
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation
High
CVE-2025-12844
AI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization
Medium
CVE-2025-67559
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Missing Authorization
Medium
CVE-2025-67472
Online Booking & Scheduling Calendar for WordPress by vcita <= 4.5.5 - Cross-Site Request Forgery
High
CVE-2025-12733
Import any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic
Medium
CVE-2025-64218
Passster <= 4.2.19 - Unauthenticated Information Exposure
Medium
CVE-2025-12954
Timetable and Event Schedule by MotoPress <= 2.4.15 - Insecure Direct Object Reference to Authenticated (Contributor+) Event Disclosure
Medium
CVE-2025-12377
Gallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions
Medium
CVE-2025-64293
0 Day Analytics <= 4.0.0 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-12681
Comment Edit Core – Simple Comment Editing <= 3.1.0 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-12979
Welcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure
Medium
CVE-2025-12089
Data Tables Generator by Supsystic <= 1.10.45 - Authenticated (Admin+) Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.