Critical
CVE-2025-23952
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
4b0aa44f-abe3-44c0-a43a-aacdaaa378cd
WP Email Delivery <= 1.20.11.23 - Reflected Cross-Site Scripting
Critical
CVE-2024-54362
GetShop ecommerce <= 1.3 - Unauthenticated Local File Inclusion
Critical
CVE-2025-24690
Formality <= 1.5.7 - Unauthenticated Local File Inclusion
Medium
CVE-2025-2025
Give <= 3.22.0 - Missing Authorization to Unauthenticated Arbitrary Earning Reports Disclosure via give_reports_earnings Function
Medium
CVE-2025-2267
WP01 – Speed, Security, SEO consultant <= 2.6.2 - Authenticated (Subscriber+) Arbitrary File Download
High
CVE-2025-1667
School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover
High
CVE-2025-26890
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.4 - Unauthenticated Local File Inclusion
Medium
CVE-2019-25222
Thumbnail carousel slider <= 1.0.4 - Authenticated (Admin+) SQL Injection
Critical
CVE-2025-1771
Traveler <= 3.1.8 - Unauthenticated Local File Inclusion via hotel_alone_load_more_post
High
CVE-2025-22526
PHP/MySQL CPU performance statistics <= 1.2.1 - Unauthenticated PHP Object Injection
High
CVE-2025-2325
WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-2056
WP Ghost <= 5.4.01 - Unauthenticated Limited File Read
High
CVE-2024-13913
InstaWP Connect – 1-click WP Staging & Migration <= 0.1.0.83 - Cross-Site Request Forgery to Local File Inclusion
High
CVE-2025-2103
SoundRise Music <= 1.7 - Authenticated (Subscriber+) Arbitrary Options Update
High
CVE-2024-13376
Industrial <= 1.7.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2024-13772
Civi - Job Board & Freelance Marketplace WordPress Theme <= 2.1.6.1 - Authentication Bypass
Critical
CVE-2024-13824
CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection
High
CVE-2025-1764
LoginPress <= 3.3.1 - Cross-Site Request Forgery to Arbitrary Options Update
Critical
CVE-2024-11284
WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Password Reset/Account Takeover
Medium
CVE-2025-1285
Resido - Real Estate WordPress Theme <= 3.6 - Missing Authorization to Unauthenticated Server-Side Request Forgery and API Key Settings Update
Critical
CVE-2024-11285
WP JobHunt <= 7.1 - Unauthenticated Privilege Escalation via Email Update/Account Takeover
High
CVE-2025-2107
Arielbrailovsky-Viralad <= 1.0.8 - Unauthenticated SQL Injection
Medium
CVE-2025-26579
MicroPayments <= 3.2.4 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.