Critical
CVE-2025-26873
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,681
Reset filters
High
CVE-2025-30773
TranslatePress <= 2.9.6 - Authenticated (Administrator+) PHP Object Injection
Critical
CVE-2025-2332
Export All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection
High
CVE-2025-1913
Product Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Medium
CVE-2025-2576
Ayyash Studio <= 1.0.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
High
CVE-2024-13889
WordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2025-1971
Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
High
CVE-2025-0724
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2024-13737
Motors – Car Dealer, Classifieds & Listing <= 1.4.57 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Listing Template Creation
High
CVE-2024-13921
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Critical
CVE-2024-13410
CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler
High
CVE-2025-22526
PHP/MySQL CPU performance statistics <= 1.2.1 - Unauthenticated PHP Object Injection
Critical
CVE-2024-13824
CiyaShop - Multipurpose WooCommerce Theme <= 4.19.0 - Unauthenticated PHP Object Injection
High
CVE-2024-10942
All in One WP Migration <= 7.89 - Unauthenticated PHP Object Injection
Medium
CVE-2025-28862
Comment Date and Gravatar remover <= 1.0 - Cross-Site Request Forgery
High
CVE-2024-13906
Gallery by BestWebSoft – Customizable Image and Photo Galleries for WordPress <= 4.7.3 - Authenticated (Administrator+) PHP Object Injection
High
CVE-2024-13777
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection
High
CVE-2025-0956
WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection
Critical
CVE-2024-13787
VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2024-11719
tarteaucitron.js for WordPress < 0.3.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-11718
tarteaucitron.js for WordPress < 0.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Critical
CVE-2024-13786
Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection
High
CVE-2025-0769
PixelYourSite – Your smart PIXEL (TAG) & API Manager <= 10.1.1.1 - Unauthenticated PHP Object Injection
High
CVE-2024-13833
Album Gallery – WordPress Gallery <= 1.6.3 - Authenticated (Editor+) PHP Object Injection via Gallery Meta
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.