Medium
CVE-2024-13589
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-13854
Education Addon for Elementor <= 1.3.1 - Authenticated (Contributor+) Insecure Direct Object Reference via naedu_elementor_template Shortcode
Medium
CVE-2024-13711
Pollin <= 1.01.1 - Reflected Cross-Site Scripting
Medium
CVE-2024-13660
Responsive Flickr Slideshow <= 2.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13663
Coaching Staffs <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13719
PeproDev Ultimate Invoice <= 2.0.9 - Insecure Direct Object Reference to Unauthenticated Order Information Exposure
Medium
CVE-2024-11335
UltraEmbed – Advanced Iframe Plugin For WordPress with Gutenberg Block Included <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-12069
Lexicata <= 1.0.16 - Reflected Cross-Site Scripting
Medium
CVE-2024-11753
UMich OIDC Login <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13657
Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-0865
WP Media Category Management 2.0 - 2.3.3 - Cross-Site Request Forgery to Settings Update
Medium
CVE-2024-12339
Digihood HTML Sitemap <= 3.1.1 - Reflected Cross-Site Scripting via 'channel'
Medium
CVE-2024-13679
Widget BUY.BOX <= 3.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13676
Categorized Gallery Plugin <= 2.0 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2024-11778
CanadaHelps Embedded Donation <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13674
Cosmic Blocks (40+) Content Editor Blocks Collection <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13462
WP Wiki Tooltip <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13736
Pure Chat – Live Chat & More! <= 2.4 - Reflected Cross-Site Scripting via purechatWidgetName Parameter
High
CVE-2024-11582
Subscribe2 – Form, Email Subscribers & Newsletters <= 10.43 - Unauthenticated Stored Cross-Site Scripting via IP Parameter
Medium
CVE-2024-13443
Easypromos Plugin <= 1.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-13508
Booking Package <= 1.6.72 - Reflected Cross-Site Scripting via Locale Parameter
Medium
CVE-2024-13743
Wonder Video Embed <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-27015
Hostiko - Hosting WordPress & WHMCS Theme < 30.1 - Unauthenticated Local File Inclusion
High
CVE-2024-13533
Small Package Quotes – USPS Edition <= 1.3.5 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.