Medium
CVE-2024-12809
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-12607
School Management System for Wordpress <= 92.0.0 - Authenticated (Subscriber+) SQL Injection via 'mj_smgt_show_event_task'
Medium
CVE-2024-13805
Advanced File Manager <= 5.2.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2025-0749
Homey <= 2.4.3 - Limited Authentication Bypass due to Missing Empty Value Check
Critical
CVE-2025-1475
WPCOM Member <= 1.7.5 - Authentication Bypass via 'user_phone'
Medium
CVE-2025-1383
Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Function
Medium
CVE-2025-1672
Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-13897
Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion
Medium
CVE-2025-1666
Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission
Medium
CVE-2025-22623
Ad Inserter - Ad Manager and AdSense Ads <= 2.8.0 - Reflected Cross-Site Scripting
Medium
CVE-2024-13146
Booknetic 4.0 - 4.1.4 - Cross-Site Request Forgery
High
33f17152-f273-46d0-ad37-55953adee919
Greek Multi Tool <= 2.3.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-11847
WP SVG Upload <= 1.0.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
Medium
CVE-2025-1463
Spreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish
High
CVE-2025-1702
Ultimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter
High
CVE-2024-13471
DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file
Medium
CVE-2024-13423
Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation
Medium
CVE-2024-11153
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Critical
CVE-2024-12281
Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
Critical
CVE-2024-11951
Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register
Medium
CVE-2024-13839
Company Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function
Medium
CVE-2024-13757
Master Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode
Medium
CVE-2024-11731
Master Slider – Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode
Critical
CVE-2025-1515
WP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.