Medium
CVE-2024-13389
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,456
Reset filters
Medium
CVE-2024-13340
MDTF – Meta Data and Taxonomies Filter <= 1.3.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-12477
Avada Builder <= 3.11.11 - Authenticated (Contributor+) Stored Cross-Site Scripting in Multiple Widgets
Medium
CVE-2025-23992
Toocheke Companion <= 1.166 - Authenticated (Admin+) Stored Cross-Site Scripting
High
CVE-2024-13593
BMLT Meeting Map <= 2.6.0 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-13236
Tainacan <= 0.21.12 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-23662
WP Panoramio <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-12504
Broadcast Live Video – Live Streaming : HTML5, WebRTC, HLS, RTSP, RTMP <= 6.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-13234
Product Table by WBW <= 2.1.2 - Unuthenticated SQL Injection
Medium
CVE-2024-12043
Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) <= 3.16.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-13499
GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_do_shortcode() Function
High
CVE-2024-13495
GamiPress <= 7.2.1 - Unauthenticated Arbitrary Shortcode Execution via gamipress_ajax_get_logs Function
High
CVE-2024-13496
GamiPress <= 7.3.1 - Unauthenticated SQL Injection via orderby Parameter
Medium
CVE-2024-13447
WP Hotel Booking <= 2.1.6 - Missing Authorization to Authenticated (Subscriber+) User Email Retrieval
Medium
CVE-2024-13590
Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13426
WP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting
Medium
CVE-2024-13543
Zarinpal Paid Downloads <= 2.3 - Reflected Cross-Site Scripting
Medium
CVE-2024-12117
Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-0429
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms
High
CVE-2025-24671
Save as PDF Plugin by Pdfcrowd <= 4.4.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-22702
Photography <= 7.5.2 - Missing Authorization
Medium
CVE-2024-12879
WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation
Medium
CVE-2024-13570
Stray Random Quotes <= 1.9.9 - Reflected Cross-Site Scripting
Medium
CVE-2024-13319
Themify Builder <= 7.6.5 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.