Critical
CVE-2025-28916
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 8,950
Reset filters
Medium
CVE-2025-1973
Export and Import Users and Customers <= 2.6.2 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
High
CVE-2025-1971
Export and Import Users and Customers <= 2.6.2 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
Medium
CVE-2025-2477
CryoKey <= 2.4 - Reflected Cross-Site Scripting via 'ckemail' Parameter
High
CVE-2025-0724
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.5 - Authenticated (Subscriber+) PHP Object Injection
Medium
CVE-2025-1408
ProfileGrid – User Profiles, Groups and Communities <= 5.9.4.4 - Missing Authorinzation to Authenticated (Subscriber+) Join Group Requests Management
Medium
CVE-2025-2331
GiveWP – Donation Plugin and Fundraising Platform <= 3.22.1 - Authenticated (Subscriber+) Sensitive Information Exposure
High
CVE-2025-2186
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.1 - Unauthenticated SQL Injection via 'automationId'
Medium
CVE-2025-26874
MemberSpace <= 2.1.13 - Reflected Cross-Site Scripting
Medium
CVE-2024-13920
Order Export & Order Import for WooCommerce <= 2.6.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function
High
CVE-2024-13921
Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter
High
CVE-2025-2539
File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated Arbitrary File Read
High
CVE-2025-1770
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
Critical
CVE-2025-2505
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
Critical
CVE-2025-26909
Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion
Critical
CVE-2024-12922
Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_current
High
CVE-2024-12563
s2Member Pro <= 250214 - Authenticated (Contributor+) Local File Inclusion to Remote Code Execution via Shortcode
High
CVE-2024-12295
BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_password
Critical
CVE-2024-13790
MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File Inclusion
Critical
CVE-2024-13442
Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeover
Critical
CVE-2024-13410
CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handler
Medium
CVE-2025-2290
LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing
Critical
CVE-2025-23937
LinkedIn Lite <= 1.0 - Unauthenticated Local File Inclusion
Medium
CVE-2024-51624
Já-Já Pagamentos for WooCommerce <= 1.3.0 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.