Medium
CVE-2025-26554
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2024-13124
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.32 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-26556
WP AntiDDOS <= 2.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-1446
Pods – Custom Content Types and Fields <= 3.2.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2025-26555
Debug-Bar-Extender <= 0.5 - Reflected Cross-Site Scripting
Medium
CVE-2024-9450
Free Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking <= 1.3.14 - Cross-Site Request Forgery
Medium
CVE-2024-13727
MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting
Medium
CVE-2025-26548
Random Image Selector <= 2.4 - Reflected Cross-Site Scripting
High
ghsa-c85w-x26q-ch87
Formwork improperly validates input of User role preventing site and panel availability
Medium
ghsa-vf6x-59hh-332f
Formwork has a cross-site scripting (XSS) vulnerability in Site title
Medium
CVE-2025-1491
WP Posts Carousel <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via auto_play_timeout Parameter
High
CVE-2025-26535
Bitcoin / AltCoin Payment Gateway for WooCommerce <= 1.7.6 - Unauthenticated SQL Injection
Critical
CVE-2024-13786
Education Center | LMS & Online Courses WordPress Theme <= 3.6.10 - PHP Object Injection
Medium
CVE-2025-1404
Secure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Function
High
CVE-2025-1686
Pebble has Arbitrary Local File Inclusion (LFI) Vulnerability via `include` macro
High
CVE-2024-13611
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss <= 2.6.9 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Critical
CVE-2024-12824
Nokri – Job Board WordPress Theme <= 1.6.2 - Unauthenticated Arbitrary Password Change
High
CVE-2024-13568
Fluent Support – Helpdesk & Customer Support Ticket System <= 1.8.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Medium
CVE-2024-13559
TemplatesNext ToolKit <= 3.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-9212
SKU Generator for WooCommerce <= 1.6.2 - Reflected Cross-Site Scripting
Medium
CVE-2025-0820
Clicface Trombi <= 2.08 - Authenticated (Contributor+) Stored Cross-Site Scripting via nom Parameter
Medium
CVE-2024-9217
Currency Switcher for WooCommerce <= 2.16.2 - Reflected Cross-Site Scripting
Medium
CVE-2024-13750
Multilevel Referral Affiliate Plugin for WooCommerce <= 2.28 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-13518
Simple:Press <= 6.10.12 - Cross-Site Request Forgery to Unauthorized Post Editing
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.