Medium
CVE-2025-0954
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2024-13777
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection
Medium
CVE-2024-13815
Listingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2024-13810
Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import
High
CVE-2025-0956
WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection
Medium
CVE-2024-13811
Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import
Medium
CVE-2024-12815
Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-13232
WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation
Medium
CVE-2024-13866
Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-0990
I Am Gloria <= 1.1.4 - Cross-Site Request Forgery
Medium
CVE-2025-1008
Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter
Medium
CVE-2024-13827
Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions
Medium
CVE-2024-13350
SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13747
WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection
Critical
CVE-2024-13787
VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2024-13863
Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting
High
CVE-2024-13618
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-1452
Favorites <= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-13809
Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-1798
Design Comuni Italia <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-13778
Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-8682
JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration
Medium
CVE-2024-5667
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library
High
CVE-2024-13617
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.