Medium
CVE-2025-1065
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
High
CVE-2025-0521
Post SMTP <= 3.0.2 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2024-12860
CarSpot – Dealership Wordpress Classified Theme <= 2.4.3 - Unauthenticated Arbitrary Password Reset/Account Takeover
Medium
CVE-2024-13538
BigBuy Dropshipping Connector for WooCommerce <= 2.0.0 - Unauthenticated Full Path Disclosute
Medium
CVE-2024-13540
WooODT Lite – Delivery & pickup date time location for WooCommerce <= 2.5.1 - Unauthenticated Full Path Dsiclosure
High
CVE-2024-13852
Option Editor <= 1.0 - Cross-Site Request Forgery to Arbitrary Options Update
High
CVE-2024-13622
File Uploads Addon for WooCommerce <= 1.7.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
High
CVE-2024-13677
GetBookingsWp - Appointments & Bookings Plugin Basic Version <= 1.1.27 - Authenticated (Subscriber+) Privilege Escalation via Account Takeover
Critical
CVE-2024-13725
Keap Official Opt-in Forms <= 2.0.1 - Unauthenticated Limited Local File Inclusion
Medium
CVE-2024-13535
Actionwear products sync <= 2.3.2 - Unauthenticated Full Patch Disclosure
Medium
CVE-2024-13783
FormCraft <= 3.9.11 - Missing Authorization to Plugin Data Export in formcraft-main.php
Medium
CVE-2024-11895
Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-1128
Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion
High
CVE-2024-13556
Affiliate Links: WordPress Plugin for Link Cloaking and Link Management <= 3.0.1 - Missing Authorization to Unauthenticated Import/Export and PHP Object Injection
Critical
CVE-2024-56000
K Elements <= 5.3.9 - Authentication Bypass
Medium
CVE-2024-13438
SpeedSize Image & Video AI-Optimizer <= 1.5.1 - Cross-Site Request Forgery to Clear Cache
Medium
CVE-2025-23956
WP Easy Post Mailer <= 0.64 - Reflected Cross-Site Scripting
Medium
CVE-2025-0822
Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter
Medium
CVE-2024-13500
WP Project Manager <= 2.6.17 - Authenticated (Subscriber+) SQL Injection via orderby Parameter
Medium
CVE-2024-13752
WP Project Manager <= 2.6.17 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update
Medium
CVE-2024-13525
Customer Email Verification for WooCommerce <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure
Critical
CVE-2024-13513
Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.3 - Sensitive Information Exposure to Privilege Escalation
Medium
CVE-2025-26779
Keep Backup Daily <= 2.1.0 - Authenticated (Admin+) Arbitrary File Download
Medium
CVE-2024-13825
Email Keep <= 1.1 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.