Critical
CVE-2024-13789
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2024-13855
Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode
Medium
CVE-2025-1328
Typed JS: A typewriter style animation <= 1.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via typespeed Parameter
High
CVE-2024-13888
WPMobile.App <= 11.56 - Open Redirect via 'redirect' Parameter
Medium
CVE-2025-0897
Modal Window <= 6.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via iframeBox Shortcode
Medium
CVE-2024-13155
Unlimited Elements For Elementor (Free Widgets, Addons, Templates) <= 1.5.140 - Authenticated (Contributor+) Stored Cross-Site Scripting via Transparent Split Hero Widget
Medium
CVE-2025-26620
Duende.AccessTokenManagement race condition when concurrently retrieving customized Client Credentials Access Tokens
Medium
CVE-2025-27089
Directus allows updates to non-allowed fields due to overlapping policies
Medium
CVE-2025-31674
Drupal core - SA-CORE-2025-003
Medium
CVE-2025-31673
Drupal core - SA-CORE-2025-002
Medium
CVE-2025-3057
Drupal core - SA-CORE-2025-001
Medium
CVE-2024-13445
Elementor Website Builder – More Than Just a Page Builder <= 3.27.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2024-13792
WooCommerce Food - Restaurant Menu & Food ordering <= 3.3.2 - Unauthenticated Arbitrary Shortcode Execution via ids
Medium
CVE-2025-1064
Login/Signup Popup ( Inline Form + Woocommerce ) <= 2.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via xoo_el_action Shortcode
Medium
CVE-2025-1043
Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files <= 2.7.5 - Authenticated (Contributor+) Blind Server-Side Request Forgery via embeddoc Shortcode
High
CVE-2024-13476
LTL Freight Quotes – GlobalTranz Edition <= 2.3.11 - Unauthenticated SQL Injection
High
CVE-2025-1039
Lenix Elementor Leads addon <= 1.8.2 - Unauthenticated Stored Cross-Site Scripting via URL Form Field
Medium
CVE-2025-1483
LTL Freight Quotes – GlobalTranz Edition <= 2.3.12 - Missing Authorization to Unauthenticated Settings Update
Medium
CVE-2025-26973
Social Sharing Plugin – Social Warfare <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-0968
ElementsKit Elementor addons <= 3.4.0 - Unauthenticated Information Exposure via get_megamenu_content Function
High
CVE-2025-0916
YaySMTP 2.4.9 - 2.6.3 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2024-13479
LTL Freight Quotes – SEFL Edition <= 3.2.4 - Unauthenticated SQL Injection
High
CVE-2024-13534
Small Package Quotes – Worldwide Express Edition <= 5.2.18 - Unauthenticated SQL Injection
Medium
CVE-2024-13231
WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.