Medium
CVE-2025-1435
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-13779
Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting
Medium
CVE-2024-13780
Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion
Medium
CVE-2025-0958
Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion
Medium
CVE-2025-0370
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
Medium
CVE-2024-13682
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery
Medium
CVE-2024-13724
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization
Medium
CVE-2024-9618
Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-0433
Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
Medium
CVE-2025-0512
Structured Content (JSON-LD) #wpsc <= 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via sc_fs_local_business Shortcode
High
CVE-2025-1306
Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2025-26895
m1.DownloadList <= 0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-11109
WP Google Review Slider <= 15.5 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-1639
Animation Addons for Elementor Pro <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Medium
CVE-2024-12812
WP ERP <= 1.13.3 - Authenticated (Employee+) Insecure Direct Object Reference
Medium
CVE-2024-10143
MB Custom Post Types & Custom Taxonomies <= 2.7.6 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-13383
HD Quiz <= 1.8.14 - Authenticated (Editor+) Stored Cross-Site Scripting
Medium
CVE-2025-1321
teachPress <= 9.0.7 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2024-9390
RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-13384
Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.23 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-9770
WP-Recall – Registration, Profile, Commerce & More <= 16.26.11 - Authenticated (Admin+) SQL Injection
Medium
CVE-2024-13621
The GDPR Framework By Data443 <= 2.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-12109
Product Labels For Woocommerce (Sale Badges) <= 1.5.8 - Authenticated (Admin+) SQL Injection
Medium
CVE-2025-26989
Zigaform – Form Builder Lite <= 7.4.2 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.