Critical
CVE-2025-25130
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-25132
Visitor Details <= 1.0.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-25118
Top Bar – PopUps – by WPOptin <= 2.0.8 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2025-25141
Fami Sales Popup <= 2.0.0 - Unauthenticated Local File Inclusion
Critical
CVE-2025-25109
WP Vehicle Manager <= 3.1 - Unauthenticated Local File Inclusion
Medium
CVE-2024-11829
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13372
WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Arbitrary Resume Download
Medium
CVE-2025-0365
Jupiterx Core <= 4.8.7 - Authenticated (Contributor+) Arbitrary File Read
Medium
CVE-2024-13371
WP Job Portal <= 2.2.6 - Missing Authorization to Unauthenticated Arbitrary Email Sending
Medium
CVE-2024-13428
WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Unauthenticated Company Logo Deletion
Medium
CVE-2024-13425
WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
Medium
CVE-2024-13429
WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion
Medium
CVE-2024-13651
RapidLoad – Optimize Web Vitals Automatically <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset
Medium
CVE-2024-13775
WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure
High
CVE-2025-0366
Jupiter X Core <= 4.8.7 - Authenticated (Contributor+) SVG Upload to Local File Inclusion (Remote Code Execution)
Medium
CVE-2024-13612
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-12041
Directorist – AI-Powered WordPress Business Directory Plugin with Classified Ads Listings <= 8.0.12 - Unauthenticated User Information Exposure
Medium
CVE-2024-12415
AI Infographic Maker <= 4.9.0 - Unauthenticated Arbitrary Shortcode Execution
High
CVE-2024-12129
Royal Core <= 2.9.2 - Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2024-12177
Ai Image Alt Text Generator for WP <= 1.0.6 - Reflected Cross-Site Scripting
Critical
CVE-2024-12822
Media Manager for UserPro <= 3.12.0 - Missing Authorization to Unauthenticated Arbitrary Options Update
High
CVE-2024-12821
Media Manager for UserPro <= 3.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
High
CVE-2024-13671
Music Sheet Viewer <= 4.1 - Unauthenticated Arbitrary File Read
High
CVE-2024-10591
MWB HubSpot for WooCommerce – CRM, Abandoned Cart, Email Marketing, Marketing Automation & Analytics <= 1.5.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.