Medium
CVE-2024-13920
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
High
CVE-2024-13921
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Low
CVE-2024-13922
Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function
High
CVE-2024-13923
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
High
CVE-2025-2539
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
High
CVE-2025-1770
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-1766
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
Medium
CVE-2025-1314
Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
Medium
CVE-2025-23638
Frontend Post Submission <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-23707
En Masse <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-23667
custom-post-edit <= 1.0.4 - Reflected Cross-Site Scripting
Critical
CVE-2025-2505
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
Medium
CVE-2025-23554
Off Page SEO <= 3.0.3 - Reflected Cross-Site Scripting
Critical
CVE-2025-26909
Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion
Medium
CVE-2025-23612
Pixobe Cartography <= 1.0.1 - Reflected Cross-Site Scripting
Medium
CVE-2024-6860
WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Permalink Suffix Update
Medium
CVE-2025-23632
CG Button <= 1.0.5.6 - Reflected Cross-Site Scripting
Medium
CVE-2024-6857
WP MultiTasking <= 0.1.12 - Cross-Site Request Forgery to Header/Footer/Body Script Update
Medium
CVE-2025-1802
HT Mega – Absolute Addons For Elementor <= 2.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Medium
CVE-2025-23705
Zielke Design Project Gallery <= 2.5.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-23633
WP Database Audit <= 1.0 - Reflected Cross-Site Scripting
Medium
CVE-2024-8243
WordPress/Plugin Upgrade Time Out Plugin <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-23680
Narnoo Operator <= 2.0.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-23666
Management-screen-droptiles <= 1.0 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.