Medium
CVE-2024-13428
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2025-22704
WordPress Signature <= 0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-13425
WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Company Deletion
Medium
CVE-2025-22698
Accessibility Suite by Ability, Inc <= 4.18 - Missing Authorization
Medium
CVE-2024-13429
WP Job Portal <= 2.2.6 - Insecure Direct Object Reference to Authenticated (Employer+) Arbitrary Job Deletion
Medium
CVE-2025-22260
Meta Tag Manager <= 3.1 - Missing Authorization
Medium
CVE-2025-22690
DigiTimber cPanel Integration <= 1.4.6 - Cross-Site Request Forgery to Stored Cross-site Scripting
Medium
CVE-2025-22705
Disqus Popular Posts <= 2.1.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-24707
Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery <= 2.7.7.24 - Reflected Cross-Site Scripting
Medium
CVE-2025-22686
CF7 Google Sheets Connector <= 5.0.17 - Missing Authorization
Medium
CVE-2024-50500
Shortcodes and extra features for Phlox theme <= 2.17.4 - Missing Authorization
Medium
CVE-2024-13341
MultiLoca - WooCommerce Multi Locations Inventory Management <= 4.1.11 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-13651
RapidLoad – Optimize Web Vitals Automatically <= 2.4.4 - Missing Authorization to Authenticated (Subscriber+) Limited Setting Reset
Medium
CVE-2024-13775
WooCommerce Support Ticket System <= 17.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion and Information Exposure
Medium
CVE-2024-13314
Carousel, Slider, Gallery by WP Carousel <= 2.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-12184
WordPress Contact Forms by Cimatti <= 1.9.4 - Missing Authorization to Unauthenticated Form Submission Download
Medium
CVE-2024-13585
Ajax Search Lite <= 4.12.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-22683
NotificationX <= 2.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-0522
LikeBot – Decentralized like-system <= 0.85 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-11780
Site Search 360 <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-22682
Hesabfa Accounting <= 2.1.2 - Reflected Cross-Site Scripting
Medium
CVE-2024-12825
Custom Related Posts <= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates
Medium
CVE-2025-24699
WP Coder – Code Snippets + HTML, CSS, JS and PHP Injection <= 3.6.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-22700
Traveler Code <= 3.1.1 - Authenticated (Subscriber+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.