Medium
CVE-2025-28933
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-13413
ProductDyno <= 1.0.24 - Reflected Cross-Site Scripting via 'res' Parameter
Critical
CVE-2025-1661
HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion
Medium
CVE-2024-13436
Appsero Helper <= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-2169
WPCS – WordPress Currency Switcher Professional <= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2024-13228
Qubely – Advanced Gutenberg Blocks <= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely_get_content
Medium
CVE-2025-0613
Photo Gallery by 10Web <= 1.8.33 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-1926
Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification
Medium
CVE-2025-26910
WPBookit <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-13649
140+ Widgets | Xpro Addons For Elementor – FREE <= 1.4.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13675
SlingBlocks – Gutenberg Blocks by FunnelKit (Formerly WooFunnels) <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-1323
WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection
Medium
CVE-2025-1325
WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Exeuction
High
CVE-2024-13908
SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2024-12114
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Post/Page Updates
Medium
CVE-2024-12119
FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel <= 2.4.29 - Authenticated (Custom+) Stored Cross-Site Scripting via Album Title Size
Medium
CVE-2024-13844
Post SMTP <= 3.1.2 - Authenticated (Administrator+) SQL Injection via columns Parameter
Medium
CVE-2025-1481
Shortcode Cleaner Lite <= 1.0.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Export
High
CVE-2024-13890
Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection
High
CVE-2024-13835
Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation
Medium
CVE-2024-12460
Years Since – Timeless <= 1.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13895
Code Snippets CPT <= 2.1.0 - Authenticated (Subscriber+) Arbitrary Shortcode Execution
Medium
CVE-2024-13774
Wishlist for WooCommerce: Multi Wishlists Per Customer <= 3.1.7 - Cross-Site Request Forgery to Cross-Site Scriping via Wishlist Name
Medium
CVE-2025-1287
The Plus Addons for Elementor – Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce <= 6.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.