Medium
CVE-2024-13526
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Critical
CVE-2024-12876
Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change
High
CVE-2024-9658
School Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation
Medium
CVE-2024-12743
MailPoet <= 5.5.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2024-13313
AWeber <= 7.3.20 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-13906
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-1309
UiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.04 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
High
CVE-2024-12036
CS Framework <= 7.1 - Authenticated (Subscriber+) Arbitrary File Read
Critical
CVE-2024-12281
Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
Critical
CVE-2024-11951
Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register
High
CVE-2024-13777
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection
High
CVE-2025-0956
WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection
Medium
CVE-2024-13747
WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection
Critical
CVE-2024-13787
VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2024-13617
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download
Medium
CVE-2025-1435
bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation
Medium
CVE-2025-0329
AI ChatBot for WordPress – WPBot <= 6.2.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Critical
CVE-2025-0912
GiveWP – Donation Plugin and Fundraising Platform <= 3.19.4 - Unauthenticated PHP Object Injection
Medium
CVE-2024-12683
Smart Maintenance Mode <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-12682
Smart Maintenance Mode <= 1.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-13382
Calculated Fields Form <= 5.2.63 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-13727
MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting
Critical
CVE-2024-13786
Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection
Medium
CVE-2025-1404
Secure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Function
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.