High
CVE-2025-27264
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2025-27263
Doctor Appointment Booking <= 1.0.0 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-27292
WPYog Documents <= 1.3.5 - Reflected Cross-Site Scripting
High
CVE-2025-27282
Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2025-27354
Simple Email Subscriber <= 2.3 - Reflected Cross-Site Scripting
Medium
CVE-2025-27308
WP Video Posts <= 3.5.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-27333
Protected wp-login <= 2.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-27346
Rebuild Permalinks <= 1.6 - Reflected Cross-Site Scripting
Critical
CVE-2025-27270
Residential Address Detection <= 2.5.4 - Unauthenticated Arbitrary Options Update
Medium
CVE-2025-27269
.htaccess Login block <= 0.9a - Reflected Cross-Site Scripting
Medium
CVE-2025-27289
Restrict Taxonomies <= 1.3.3 - Reflected Cross-Site Scripting
High
CVE-2024-13869
Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
Medium
CVE-2025-27283
Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Download
Medium
CVE-2024-13900
Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments
Medium
CVE-2024-13713
WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-13846
Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter
Medium
CVE-2025-1489
WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode
High
CVE-2024-13353
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-12276
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
Medium
CVE-2025-1410
Events Calendar Made Simple – Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode
High
CVE-2024-11260
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter
Medium
CVE-2024-13235
Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-13379
C9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-13388
TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.