High
CVE-2025-1702
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,616
High
CVE-2024-13471
DesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file
Medium
CVE-2024-13423
Sparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation
Medium
CVE-2024-11153
Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure
Critical
CVE-2024-12281
Homey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile
Critical
CVE-2024-11951
Homey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register
Medium
CVE-2024-13839
Company Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function
Medium
CVE-2024-13757
Master Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode
Medium
CVE-2024-11731
Master Slider – Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode
Critical
CVE-2025-1515
WP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover
Medium
CVE-2025-0954
WP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import
High
CVE-2024-13777
ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection
Medium
CVE-2024-13815
Listingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2024-13810
Zass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import
High
CVE-2025-0956
WooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection
Medium
CVE-2024-13811
Lafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import
Medium
CVE-2024-12815
Point Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-13232
WordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation
Medium
CVE-2024-13866
Simple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-0990
I Am Gloria <= 1.1.4 - Cross-Site Request Forgery
Medium
CVE-2025-1008
Recently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter
Medium
CVE-2024-13827
Razorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions
Medium
CVE-2024-13350
SearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13747
WooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.