Medium
CVE-2025-1664
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-13816
Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.6 - Missing Authorization to Authenticated (Subscriber+) Multiple Administrator Actions
Medium
CVE-2025-1289
Plugin Oficial – Getnet para WooCommerce <= 1.8.0 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-11640
VikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-1504
Post Lockdown <= 4.0.2 - Missing Authorization to Authenticated (Subscriber+) Post Disclosure
Medium
CVE-2025-1324
WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-10321
All-in-One Addons for Elementor – WidgetKit <= 2.5.5 - Authenticated (Contributor+) Sensitive Information Exposure via Elementor Templates
Medium
CVE-2024-13640
Print Invoice & Delivery Notes for WooCommerce <= 5.4.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2025-1768
SEO Plugin by Squirrly SEO <= 12.4.05 - Authenticated (Subscriber+) SQL Injection via search Parameter
Medium
CVE-2024-12634
Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.59 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-13635
VK Blocks <= 1.94.2.2 - Missing Authorization to Sensitive Information Exposure
Medium
CVE-2024-13857
WPGet API <= 2.2.10 - Authenticated (Administrator+) Server-Side Request Forgery
Medium
CVE-2024-13552
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.0 - Insecure Direct Object Reference
Medium
CVE-2024-13431
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.8.3 - Reflected Cross-Site Scripting
High
CVE-2024-10804
Ultimate Video Player <= 10.0 - Unauthenticated Arbitrary File Download
High
CVE-2025-0959
Eventer - WordPress Event & Booking Manager Plugin <= 3.9.9.2 - Authenticated (Subscriber+) SQL Injection via reg_id
Medium
CVE-2024-13781
Hero Maps Premium - Customizable Google Maps Plugin <= 2.3.9 - Authenticated (Subscriber+) SQL Injection
Critical
CVE-2025-1315
InWave Jobs <= 3.5.1 - Unauthenticated Privilege Escalation via Password Reset
Medium
CVE-2024-13526
EventPrime – Events Calendar, Bookings and Tickets <= 4.0.7.3 - Missing Authorization to Authenticated (Subscriber+) Event Attendees Export
Medium
CVE-2025-1762
Event Tickets with Ticket Scanner <= 2.5.3 - Cross-Site Request Forgery to Arbitrary Ticket Deletion
Medium
CVE-2024-13118
IP Based Login <= 2.4.0 - Cross-Site Request forgery to Log Deletion
Critical
CVE-2024-12876
Golo - Directory & Listing, Travel WordPress Theme <= 1.6.10 - Missing Authorization to Privilege Escalation via Unauthenticated Arbitrary User Password Change
Medium
CVE-2024-13357
Ditty <= 3.1.51 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2024-9658
School Management System for Wordpress <= 93.0.0 - Authenticated (Student+) Account Takeover and Privilege Escalation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.