Medium
CVE-2024-13866
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-0990
I Am Gloria <= 1.1.4 - Cross-Site Request Forgery
Medium
CVE-2025-1008
Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter
Medium
CVE-2024-13827
Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions
Medium
CVE-2024-13350
SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13747
WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection
Critical
CVE-2024-13787
VEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2024-13863
Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting
High
CVE-2024-13618
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-1452
Favorites <= 2.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-13809
Hero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection
High
CVE-2025-1798
Design Comuni Italia <= 1.1.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-13778
Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-8682
JNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration
Medium
CVE-2024-5667
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library
High
CVE-2024-13617
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated Arbitrary File Download
Medium
CVE-2025-1435
bbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation
Medium
CVE-2024-13779
Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting
Medium
CVE-2024-13780
Hero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion
Medium
CVE-2025-0958
Ultimate WordPress Auction Plugin <= 4.2.9 - Missing Authorization to Arbitrary Post Deletion
Medium
CVE-2025-0370
WP Shortcodes Plugin — Shortcodes Ultimate <= 7.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via src Parameter
Medium
CVE-2024-13682
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Cross-Site Request Forgery
Medium
CVE-2024-13724
Wallet System for WooCommerce – Wallet, Wallet Cashback, Refunds, Partial Payment, Wallet Restriction <= 2.6.2 - Missing Authorization
Medium
CVE-2024-9618
Master Addons <= 2.0.7.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.