Medium
CVE-2025-27346
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Critical
CVE-2025-27270
Residential Address Detection <= 2.5.4 - Unauthenticated Arbitrary Options Update
Medium
CVE-2025-27269
.htaccess Login block <= 0.9a - Reflected Cross-Site Scripting
Medium
CVE-2025-27289
Restrict Taxonomies <= 1.3.3 - Reflected Cross-Site Scripting
High
CVE-2024-13869
Migration, Backup, Staging – WPvivid <= 0.9.112 - Authenticated (Admin+) Arbitrary File Upload via wpvivid_upload_file
Medium
CVE-2025-27283
Theme File Duplicator <= 1.3 - Authenticated (Subscriber+) Arbitrary File Download
Medium
CVE-2024-13900
Head, Footer and Post Injections <= 3.3.0 - Authenticated (Administrator+) PHP Code Injection in Multisite Environments
Medium
CVE-2024-13713
WPExperts Square For GiveWP <= 1.3.1 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-13846
Indeed Ultimate Learning Pro <= 3.9 - Authenticated (Administrator+) SQL Injection via post_id Parameter
Medium
CVE-2025-1489
WP-Appbox <= 4.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via appbox Shortcode
High
CVE-2024-13353
Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.4 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2024-12276
Ultimate Member <= 2.9.2 - Authenticated SQL Injection
Medium
CVE-2025-25299
Cross-site scripting (XSS) in the CKEditor 5 real-time collaboration package
Critical
Exploited in attacks
CVE-2025-24893
XWiki Platform allows remote code execution as guest via SolrSearchMacros request
Medium
CVE-2025-1410
Events Calendar Made Simple – Pie Calendar <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via piecal Shortcode
Medium
CVE-2024-57716
AutoQueryable leaks sensitive information
High
CVE-2024-11260
Events Manager – Calendar, Bookings, Tickets, and more! <= 6.6.3 - Unauthenticated SQL Injection via Event Status Parameter
Medium
CVE-2024-13235
Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-13379
C9 Admin Dashboard <= 1.3.5 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Medium
CVE-2024-13388
TCBD Tooltip <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-1406
Newpost Catch <= 1.3.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via npc Shortcode
Medium
CVE-2024-13751
3D Photo Gallery <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-1407
AMO Team Showcase <= 1.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via amoteam_skills Shortcode
Medium
CVE-2024-13537
C9 Blocks <= 1.7.7 - Unauthenticated Full Path Disclosure
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.