Medium
CVE-2024-25098
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 41,670
Reset filters
Medium
CVE-2024-25916
My Calendar <= 3.4.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-1274
My Calendar <= 3.4.23 - Authenticated (Admin+) Stored Cross-Site Scripting via Events
High
CVE-2024-3591
Geo Controller <= 8.6.4 - Unauthenticated PHP Object Injection via shortcode REST API Route
Medium
CVE-2024-24930
Buttons Shortcode and Widget <= 1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Medium
CVE-2024-0596
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via editor_html()
High
CVE-2024-1317
RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injection
Medium
CVE-2024-24929
WP Contact Form <= 1.6 - Cross-Site Request Forgery via wpcf_adminpage
Medium
CVE-2024-0658
Insert PHP Code Snippet <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-24933
Honeypot for WP Comment <= 2.2.3 - Reflected Cross-Site Scripting via page
Medium
CVE-2024-0595
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Missing Authorization via wpas_get_users()
Medium
CVE-2024-24931
Before After Image Slider WP <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
High
CVE-2024-0594
Awesome Support – WordPress HelpDesk & Support Plugin <= 6.1.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2024-24927
Brooklyn <= 4.9.9.2 - Reflected Cross-Site Scripting
High
CVE-2024-24926
Brooklyn <= 4.9.9.2 - PHP Object Injection
Medium
CVE-2024-24928
Content Cards <= 0.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Medium
CVE-2024-1340
Login Lockdown – Protect Login Form <= 2.08 - Missing Authorization
Medium
CVE-2024-24935
Basic Log Viewer <= 1.0.4 - Cross-Site Request Forgery via wpst_lw_viewer
Medium
CVE-2024-1318
RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publication
Medium
CVE-2024-24932
VK Poster Group <= 2.0.3 - Reflected Cross-Site Scripting via vkp_repost
Medium
CVE-2024-25092
NextMove Lite <= 2.17.0 - Missing Authorization to Authenticated(Subscriber+) Plugin Activation
Medium
f6c5e3f8-ebbd-4cc3-b9b1-3f1704e3c07a
Paid Memberships Pro <= 2.12.8 - Authenticated (Contributor+) User Meta Disclosure
Medium
CVE-2024-24889
All 404 Pages Redirect to Homepage <= 1.9 - Unauthenticated Stored Cross-Site Scripting
Critical
CVE-2024-1350
Honeypot for WP Comment <= 2.2.3 - Directory Traversal to Unauthenticated Arbitrary File Deletion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.