High
CVE-2025-2106
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2024-10942
All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection
Medium
CVE-2025-28859
Maintenance Notice <= 1.0.6 - Cross-Site Request Forgery
Medium
CVE-2025-28875
BP Email Assign Templates <= 1.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-10107
Giveaways and Contests by RafflePress <= 1.12.16 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2025-1707
Review Schema <= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta
Medium
CVE-2025-28874
BP Email Assign Templates <= 1.7 - Authenticated (Admin+) Arbitrary Option Deletion
Critical
CVE-2024-13446
Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account Takeover
Medium
CVE-2025-28923
No Disposable Email <= 2.5.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-28918
Featured Image Thumbnail Grid <= 6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-28897
Domain Theme <= 1.3 - Cross-Site Request Forgery
Medium
CVE-2024-13838
Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhook
Medium
CVE-2025-26566
In Stock Mailer for WooCommerce <= 2.1.1 - Reflected Cross-Site Scripting
Critical
CVE-2025-1661
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
Medium
CVE-2024-13844
Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
High
CVE-2024-13835
Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
Medium
CVE-2025-1287
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Critical
CVE-2025-0177
Javo Core <= 3.0.0.080 - Unauthenticated Privilege Escalation in ajax_signup
High
CVE-2024-13882
Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload
Medium
CVE-2024-13816
Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
Medium
CVE-2024-13640
Print Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2024-13552
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
High
CVE-2024-10804
Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download
Critical
CVE-2025-1315
InWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation via Password Reset
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.