Critical
CVE-2025-23932
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-23456
EmailShroud <= 2.2.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting
Medium
CVE-2025-23525
Kv Compose Email From Dashboard <= 1.1 - Reflected Cross-Site Scripting
High
CVE-2025-23914
Optimize Your Campaigns – Google Shopping – Google Ads – Google Adwords <= 3.1 - Unauthenticated PHP Object Injection
Medium
CVE-2025-23675
Import Users to MailChimp <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-23481
Ni WooCommerce Sales Report Email <= 3.1.4 - Reflected Cross-Site Scripting
High
CVE-2025-23949
Improved Sale Badges – Free Version <= 1.0.1 - Authenticated (Subscriber+) Local File Inclusion
Medium
CVE-2025-23676
LH Email <= 1.12 - Reflected Cross-Site Scripting
Medium
CVE-2025-22661
Online Payments – Get Paid with PayPal, Square & Stripe <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-22727
MailChimp Subscribe Forms <= 4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-22766
Zarinpal Paid Download <= 2.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-22773
Htaccess File Editor <= 1.0.19 - Unauthenticated Information Exposure
Medium
CVE-2025-22758
Elementor AI Addons <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-0466
Sensei LMS – Online Courses, Quizzes, & Learning <= 4.24.3 - Unauthenticated Information Exposure
High
CVE-2024-11848
NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
High
CVE-2025-0394
Groundhogg <= 3.7.3.5 - Authenticated (Author+) Arbitrary File Upload via gh_big_file_upload Function
High
CVE-2024-12365
W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery
Medium
CVE-2024-11396
Event monster <= 1.4.3 - Information Exposure Via Visitors List Export
Critical
CVE-2024-12919
Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.13.7 - Authentication Bypass via pms_payment_id
Medium
CVE-2024-12008
W3 Total Cache <= 2.8.1 Information Exposure via Log Files
High
CVE-2025-22786
ElementInvader Addons for Elementor <= 1.2.6 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-11386
GatorMail SmartForms <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-12520
Dominion – Domain Checker for WPBakery <= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-12304
Gutenberg Blocks with AI by Kadence WP – Page Builder Features <= 3.4.2 - Authenticated (contributor+) Stored Cross-Site Scripting via Button Link
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.