Medium
eb0b9c2b-c536-4697-be4c-7557ba66c2c4
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
8f7b0a1c-16d7-45db-b419-569ed5c4a5e4
Make, formerly Integromat Connector <= 1.5.2 - Authenticated (Subscriber+) Information Disclosure
Medium
da0950ad-4d6c-46fe-83c9-c14653fe9f1f
Backup Scheduler <= 1.5.13 - Missing Authorization to Sensitive Information Disclosure
Medium
CVE-2022-36340
MailOptin <= 1.2.49.0 - Missing Authorization to Cache Deletion
Medium
CVE-2022-38134
Customer Reviews for WooCommerce <= 5.3.5 - Multiple Unprotected AJAX Actions
Medium
CVE-2022-38470
Customer Reviews for WooCommerce <= 5.3.5 - Cross-Site Request Forgery
Medium
CVE-2022-40194
Customer Reviews for WooCommerce <= 5.3.5 - Sensitive Data Exposure
Medium
cbdb3be2-50c5-4516-bce1-8785e338fe5c
Tidio – Live Chat, Chatbots & Email Integration <= 5.2.0 - Sensitive Information Disclosure
Medium
CVE-2022-3244
WP Ultimate CSV Importer <= 6.5.7 - Missing Authorization
Medium
a2ad2c0d-542e-4b40-91a8-19b27297545e
Contact Form by WPForms <= 1.7.5.3 - Authenticated (Administrator+) Arbitrary File Access via Path Traversal
Medium
48784892-443f-452c-9fe9-12e73af1cf7f
Booster for WooCommerce (Free <= 5.6.2 and Premium <= 5.6.0) - Authenticated (Subscriber+) Order Modification
Medium
52a03c45-1d65-43aa-b30f-13698019e05f
miniOrange's Google Authenticator <= 5.5.82 - Missing Authorization
Medium
CVE-2022-2891
WP 2FA <= 2.2.1 - Time-Based TOTP attack to Sensitive Information Exposure
Medium
CVE-2022-3194
Dokan <= 3.6.3 - Authenticated (Vendor+) Stored Cross-Site Scripting
High
CVE-2022-36388
YDS Support Ticket System <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2022-40195
PCA Predict <= 1.0.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2022-2405
WP Popup Builder <= 1.2.9 - Missing Authorization and Cross-Site Request Forgery
High
CVE-2022-2903
Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.6.12 - Authenticated (Administrator+) PHP Objection Injection
Medium
CVE-2022-2352
Post SMTP <= 2.1.6 - Authenticated (Administrator+) Blind Server-Side Request Forgery
High
CVE-2022-38093
All in One SEO <= 4.2.3.1 - Cross-Site Request Forgery
Medium
CVE-2022-36796
CallRail Phone Call Tracking <= 0.4.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2022-40310
Rate my Post – WP Rating System <= 3.3.4 - Race Condition
Medium
CVE-2022-2935
Image Hover Effects Ultimate <= 9.7.3 - Authenticated Stored Cross-Site Scripting via Media URL
Medium
CVE-2022-1613
Restricted Site Access <= 7.3.1 - Access Bypass via IP Spoofing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.