CVEs published June 27, 2025
223 CVEs were published on June 27, 2025: 22 critical, 90 high. Browse them by severity, product and exploitation status.
- Published
- 223
- Critical
- 22
- High
- 90
- Medium
- 100
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- NixOS Nix
- 5
- Flock Safety Gunshot Detection devices
- 4
- Flock Safety License Plate Reader
- 3
- huija bicycleSharingServer
- 3
- sfturing hosp_order
- 3
- code-projects Food Distributor Site
- 2
- Imagination Technologies Graphics DDK
- 2
- lucidcrew WP Forum Server
- 2
- RooCodeInc Roo-Code
- 2
- TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15
- 2
Critical 22
- CVE-2025-5310Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical FunctionDover Fueling Solutions ProGauge MagLink LX
- CVE-2024-12143SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDBMobilteg Mobile Informatics Mikro Hand Terminal - MikroDB
- CVE-2024-12150SQLi in Eron Software's Wowwo CRMEron Software Wowwo CRM
- CVE-2024-12364SQLi in Mavi Yeşil Software's Guest Tracking SoftwareMavi Yeşil Software Guest Tracking Software
- CVE-2024-11739SQLi in Case Informatics' Case ERPCase Informatics Case ERP
- CVE-2025-53091WeGIA has Unauthenticated Time-Based Blind SQL Injection in almox ParameterLabRedesCefetRJ WeGIA
- CVE-2025-53314WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerabilitysh1zen WP Optimizer
- CVE-2025-53260WordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload Vulnerabilitygetredhawkstudio File Manager Plugin For Wordpress
- CVE-2025-28970WordPress WP Optimize By xTraffic plugin <= 5.1.6 - PHP Object Injection Vulnerabilitypep.vn WP Optimize By xTraffic
- CVE-2025-39474WordPress Amely theme <= 3.1.4 - SQL Injection vulnerabilityThemeMove Amely
- CVE-2025-49885WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload VulnerabilityHaruTheme Drag and Drop Multiple File Upload (Pro) - WooCom…
- CVE-2025-52717WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerabilitychrisbadgett LifterLMS
- CVE-2025-52722WordPress Classiera theme <= 4.0.34 - SQL Injection VulnerabilityJoinWebs Classiera
- CVE-2025-52724WordPress Amwerk theme <= 1.2.0 - PHP Object Injection VulnerabilityBoldThemes Amwerk
- CVE-2025-52725WordPress CouponXxL theme <= 3.0.0 - PHP Object Injection Vulnerabilitypebas CouponXxL
- CVE-2025-52829WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection VulnerabilityDirectIQ Email Marketing
- CVE-2025-52834WordPress Homey theme <= 2.4.7 - SQL Injection vulnerabilityfavethemes Homey
- CVE-2025-23967WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerabilitywpopal GG Bought Together for WooCommerce
- CVE-2025-6763Comet System H3531 Web-based Management setupA.cfg missing authenticationComet System T0510 · Comet System T3510 +8
- CVE-2024-12827DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Resetscriptsbundle DWT - Directory & Listing WordPress Theme
- CVE-2025-6688Simple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Adminidokd Simple Payment
- CVE-2025-52207PBXCoreREST/Controllers/Files/PostController.php in MikoPBX through 2024.1.114 allows uploading a PHP script to an arbitrary directory.MikoPBX
High 90
- CVE-2025-53098Roo Code Vulnerable to Potential Remote Code Execution via Model Context ProtocolRooCodeInc Roo-Code
- CVE-2025-53094ESPAsyncWebServer Vulnerable to CRLF Injection in AsyncWebHeader.cppESP32Async ESPAsyncWebServer
- CVE-2025-53093TabberNeue vulnerable to Stored XSS through wikitextStarCitizenTools mediawiki-extensions-TabberNeue · starciti…
- CVE-2025-6521TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic AlgorithmTrendMakers Sight Bulb Pro Firmware ZJ_CG32-2201
- CVE-2025-6705A vulnerability in the Eclipse Open VSX Registry’s automated publishing system could have allowed unauthorized uploads of extensions.Eclipse Foundation Eclipse Open VSX Registry
- CVE-2025-36595Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Directives in Statically Saved Code…Dell Unisphere for PowerMax vApp
- CVE-2025-53339WordPress Devnex Addons For Elementor plugin <= 1.0.9 - Local File Inclusion VulnerabilityDevnex Addons For Elementor
- CVE-2025-53338WordPress re.place plugin <= 0.2.1 - Cross Site Request Forgery (CSRF) Vulnerabilitydor re.place
- CVE-2025-53332WordPress Track Everything plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) Vulnerabilityethoseo Track Everything
- CVE-2025-53331WordPress RSS Digest plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerabilitysamcharrington RSS Digest
- CVE-2025-53329WordPress Społecznościowa 6 PL 2013 plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerabilityszajenw Społecznościowa 6 PL
- CVE-2025-53317WordPress WPShapere Lite plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) VulnerabilityAcmeeDesign WPShapere - WordPress admin theme
- CVE-2025-53315WordPress Relocate Upload plugin <= 0.24.1 - Cross Site Request Forgery (CSRF) Vulnerabilityalanft Relocate Upload
- CVE-2025-53313WordPress Twitch TV Embed Suite plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerabilityplumwd Twitch TV Embed Suite
- CVE-2025-53312WordPress OnionBuzz plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) VulnerabilityLooks Awesome OnionBuzz
- CVE-2025-53311WordPress Navayan Subscribe plugin <= 1.13 - Cross Site Request Forgery (CSRF) VulnerabilityAmol Nirmala Waman Navayan Subscribe
- CVE-2025-53310WordPress HidePost plugin <= 2.3.8 - Cross Site Request Forgery (CSRF) VulnerabilityFunnnny HidePost
- CVE-2025-53308WordPress Image Slider With Description plugin <= 9.2 - Cross Site Request Forgery (CSRF) Vulnerabilitygopi_plus Image Slider With Description
- CVE-2025-53306WordPress WP Forum Server plugin <= 1.8.2 - SQL Injection Vulnerabilitylucidcrew WP Forum Server
- CVE-2025-53305WordPress WP Forum Server plugin <= 1.8.2 - Cross Site Request Forgery (CSRF) Vulnerabilitylucidcrew WP Forum Server
- CVE-2025-53281WordPress WPB Category Slider for WooCommerce plugin <= 1.71 - Local File Inclusion VulnerabilityWPBean WPB Category Slider for WooCommerce
- CVE-2025-53277WordPress IS-theme-companion plugin <= 1.59 - Cross Site Request Forgery (CSRF) vulnerabilityInfigo Software IS-theme-companion
- CVE-2025-53274WordPress WP Permalink Translator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) VulnerabilityHossin Asaadi WP Permalink Translator
- CVE-2025-53271WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS VulnerabilityAnton Bond Additional Order Filters for WooCommerce
- CVE-2025-53259WordPress Hotel Booking plugin <= 3.7 - Local File Inclusion Vulnerabilitynicdark Hotel Booking
Show all 90 entriesShow fewer entries
- CVE-2025-53258WordPress Hover Effects plugin <= 2.1.2 - SQL Injection VulnerabilityWow-Company Hover Effects
- CVE-2025-53257WordPress Gmedia Photo Gallery plugin <= 1.23.0 - Local File Inclusion VulnerabilitySerhii Pasyuk Gmedia Photo Gallery
- CVE-2025-53256WordPress YaySMTP plugin <= 2.6.6 - SQL Injection VulnerabilityYayCommerce YaySMTP
- CVE-2025-24765WordPress Image Shadow plugin <= 1.1.0 - Arbitrary File Deletion VulnerabilityRobMarsh Image Shadow
- CVE-2025-24769WordPress Zenny theme <= 1.7.5 - Local File Inclusion VulnerabilityBZOTheme Zenny
- CVE-2025-24774WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymojoomla WPCRM - CRM for Contact form CF7 & WooCommerce
- CVE-2025-25171WordPress WP SmartPay plugin <= 2.7.13 - Account Takeover vulnerabilityConvers Lab WP SmartPay
- CVE-2025-25173WordPress FastBook plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityFasterThemes FastBook
- CVE-2025-27361WordPress Photo Express for Google plugin <= 0.3.2 - Reflected Cross Site Scripting (XSS) vulnerabilitythhake Photo Express for Google
- CVE-2025-28946WordPress PrintXtore theme < 1.7.8 - Local File Inclusion vulnerabilityBZOTheme PrintXtore
- CVE-2025-28947WordPress MBStore - Digital WooCommerce WordPress Theme <= 2.3 - Local File Inclusion Vulnerabilitysnstheme MBStore - Digital WooCommerce WordPress Theme
- CVE-2025-28956WordPress Backwp plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilitywphobby Backwp
- CVE-2025-28960WordPress Evangelische Termine plugin <= 3.3 - Cross Site Scripting (XSS) Vulnerabilityregibaer Evangelische Termine
- CVE-2025-28988WordPress WP Front User Submit / Front Editor plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerabilityaharonyan WP Front User Submit / Front Editor
- CVE-2025-28990WordPress SNS Vicky theme <= 3.7 - Local File Inclusion Vulnerabilitysnstheme SNS Vicky
- CVE-2025-28993WordPress Content No Cache plugin <= 0.1.4 - Arbitrary Function Call vulnerabilityJose Mortellaro Content No Cache
- CVE-2025-28998WordPress SERPed.net plugin <= 4.6 - Local File Inclusion Vulnerabilityserpednet SERPed.net
- CVE-2025-30972WordPress Woocommerce Line Notify plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerabilityiamapinan Woocommerce Line Notify
- CVE-2025-30992WordPress Puca theme <= 2.6.33 - Local File Inclusion Vulnerabilitythembay Puca
- CVE-2025-31067WordPress Seven Stars theme <= 1.4.4 - Cross Site Scripting (XSS) Vulnerabilitythemeton Seven Stars
- CVE-2025-31428WordPress HYDRO theme <= 2.8 - Reflected Cross Site Scripting (XSS) vulnerabilityBuddhaThemes HYDRO
- CVE-2025-32298WordPress CTUsers plugin <= 1.0.0 - Local File Inclusion VulnerabilityCase-Themes CTUsers
- CVE-2025-39478WordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerabilitysmartiolabs Smart Notification
- CVE-2025-39488WordPress MagOne theme <= 8.8 - Reflected Cross Site Scripting (XSS) vulnerabilitySneeit MagOne
- CVE-2025-47574WordPress School Management System Plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilitymojoomla School Management
- CVE-2025-47654WordPress FormLift for Infusionsoft Web Forms plugin <= 7.5.20 - Reflected Cross Site Scripting (XSS) vulnerabilityAdrian Tobey FormLift for Infusionsoft Web Forms
- CVE-2025-49290WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerabilityJory Hogeveen Off-Canvas Sidebars & Menus
- CVE-2025-49321WordPress Eventin plugin <= 4.0.28 - Cross Site Scripting (XSS) VulnerabilityArraytics Eventin
- CVE-2025-49883WordPress Greenmart theme <= 4.2.3 - Local File Inclusion Vulnerabilitythembay Greenmart
- CVE-2025-49886WordPress Zikzag Core plugin <= 1.4.5 - Local File Inclusion VulnerabilityWebGeniusLab Zikzag Core
- CVE-2025-50052WordPress Flexo Counter plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerabilityflexostudio Flexo Counter
- CVE-2025-52723WordPress Networker theme <= 1.2.0 - Local File Inclusion Vulnerabilitycodesupplyco Networker
- CVE-2025-52726WordPress CouponXxL Custom Post Types plugin <= 3.0 - Privilege Escalation Vulnerabilitypebas CouponXxL Custom Post Types
- CVE-2025-52727WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityQuanticaLabs CSS3 Vertical Web Pricing Tables
- CVE-2025-52729WordPress Diza theme <= 1.3.9 - Local File Inclusion Vulnerabilitythembay Diza
- CVE-2025-52774WordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerabilityInfility Global
- CVE-2025-52778WordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) VulnerabilityMichel - xiligroup dev xili-dictionary
- CVE-2025-52799WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerabilitydesignthemes LMS
- CVE-2025-52808WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerabilityreal-web RealtyElite
- CVE-2025-52809WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion VulnerabilityJohn Russell National Weather Service Alerts
- CVE-2025-52810WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion VulnerabilityTMRW-studio Katerio - Magazine
- CVE-2025-52811WordPress Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Local File Inclusion VulnerabilityCreanncy Davenport - Versatile Blog and Magazine WordPress…
- CVE-2025-52812WordPress Domnoo theme <= 1.49 - Local File Inclusion VulnerabilityApusWP Domnoo
- CVE-2025-52814WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerabilityovatheme BRW
- CVE-2025-52815WordPress CityGov theme <= 1.9 - Local File Inclusion VulnerabilityAncoraThemes CityGov
- CVE-2025-52816WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerabilitythemehunk Zita
- CVE-2025-52817WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerabilityZealousWeb Abandoned Contact Form
- CVE-2025-52818WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerabilityDejan Jasnic Trusty Whistleblowing
- CVE-2025-52824WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerabilityMDJM Mobile DJ Manager
- CVE-2025-52826WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerabilityuxper Sala
- CVE-2025-52827WordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerabilityuxper Nuss
- CVE-2023-25998WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerabilitysnstheme Samex - Clean, Minimal Shop WooCommerce WordPress…
- CVE-2025-23973WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerabilitydugudlabs SpecFit-Virtual Try On Woocommerce
- CVE-2025-24760WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerabilitygoalthemes Sofass
- CVE-2025-49416WordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion VulnerabilityFastw3b FW Gallery
- CVE-2025-49423WordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilitySyed Tahir Ali Jan Bulk YouTube Post Creator
- CVE-2025-49448WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Deletion VulnerabilityFastw3b FW Food Menu
- CVE-2025-2940Ninja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgerytechjewel Ninja Tables – Easy Data Table Builder
- CVE-2025-5306Command Injection in Netflow pathPandora FMS
- CVE-2025-36529An OS command injection issue exists in multiple versions of TB-eye network recorders and AHD recorders.TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15
- CVE-2025-6752Linksys WRT1900ACS/EA7200/EA7450/EA7500 IGD Layer3Forwarding SetDefaultConnectionService stack-based overflowLinksys WRT1900ACS · Linksys EA7200 +2
- CVE-2025-6751Linksys E8450 HTTP POST Request portal.cgi set_device_language buffer overflowLinksys E8450
- CVE-2025-44557A state machine transition flaw in the Bluetooth Low Energy (BLE) stack of Cypress PSoC4 v3.66 allows attackers to bypass the pairing…
- CVE-2025-45851An issue in Hikvision DS-2CD1321-I V5.7.21 build 230819 allows attackers to cause a Denial of Service (DoS) via sending a crafted POST…
- CVE-2025-50528A buffer overflow vulnerability exists in the fromNatStaticSetting function of Tenda AC6 <=V15.03.05.19 via the page parameter.
Medium, low and unrated 111
- CVE-2024-36347Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load…AMD EPYC™ 7001 Series · AMD EPYC™ 7002 Series +36
- CVE-2025-53097Roo Code extension vulnerable to Potential Information Leakage via JSON SchemaRooCodeInc Roo-Code
- CVE-2025-6778code-projects Food Distributor Site save_settings.php cross site scriptingcode-projects Food Distributor Site
- CVE-2025-6777code-projects Food Distributor Site process_login.php sql injectioncode-projects Food Distributor Site
- CVE-2025-6776xiaoyunjie openvpn-cms-flask File Upload controller.py upload path traversalxiaoyunjie openvpn-cms-flask
- CVE-2025-6775xiaoyunjie openvpn-cms-flask User Creation Endpoint openvpn.py create_user command injectionxiaoyunjie openvpn-cms-flask
- CVE-2025-6774gooaclok819 sublinkX template.go AddTemp path traversalgooaclok819 sublinkX
- CVE-2025-6773HKUDS LightRAG File Upload document_routes.py upload_to_input_dir path traversalHKUDS LightRAG · lightrag-hku
- CVE-2025-6772eosphoros-ai db-gpt import import_flow path traversaleosphoros-ai db-gpt
- CVE-2025-6522TrendMakers Sight Bulb Pro Command InjectionTrendMakers Sight Bulb Pro Firmware ZJ_CG32-2201
- CVE-2025-46708GPU DDK - Guest VM can delay the FW and GPU from processing workloads from other VMsImagination Technologies Graphics DDK
- CVE-2025-46707GPU DDK - Guest VM can override its own FW VZ connection state after the FW has close itImagination Technologies Graphics DDK
- CVE-2025-52553authentik has Insufficient Session verification for Remote Access Control endpoint accessgoauthentik authentik
- CVE-2023-38007IBM Cloud Pak System HTML injectionIBM Cloud Pak System
- CVE-2025-6768sfturing hosp_order HospitalServiceImpl.java findAllHosByCondition sql injectionsfturing hosp_order
- CVE-2025-53336WordPress My Resume Builder plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerabilityabditsori My Resume Builder
- CVE-2025-53327WordPress Aioseo Multibyte Descriptions plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerabilityrui_mashita Aioseo Multibyte Descriptions
- CVE-2025-53325WordPress Beauty Contact Popup Form plugin <= 6.0 - Cross Site Scripting (XSS) VulnerabilityDilip kumar Beauty Contact Popup Form
- CVE-2025-53323WordPress Pre-Publish Post Checklist plugin <= 3.1 - Broken Access Control Vulnerabilitydanbriapps Pre-Publish Post Checklist
- CVE-2025-53322WordPress Accept Authorize.NET Payments Using Contact Form 7 plugin <= 2.5 - Sensitive Data Exposure VulnerabilityZealousWeb Accept Authorize.NET Payments Using Contact Form
- CVE-2025-53321WordPress Raise The Money plugin <= 5.2 - Cross Site Scripting (XSS) VulnerabilityRaise The Money
- CVE-2025-53320WordPress Free Downloads EDD plugin <= 1.0.4 - Cross Site Scripting (XSS) VulnerabilityWp Enhanced Free Downloads EDD
- CVE-2025-53318WordPress WP DB Booster plugin <= 1.0.1 - Broken Access Control VulnerabilityWPManiax WP DB Booster
- CVE-2025-53309WordPress Accept Stripe Payments Using Contact Form 7 plugin <= 3.0 - Sensitive Data Exposure VulnerabilityZealousWeb Accept Stripe Payments Using Contact Form
- CVE-2025-53304WordPress Contact Form – 7 : Hide Success Message plugin <= 1.1.4 - Broken Access Control VulnerabilityRohil Contact Form – 7 : Hide Success Message
Show all 111 entriesShow fewer entries
- CVE-2025-53301WordPress Theme Junkie Team Content plugin <= 0.1.1 - Cross Site Scripting (XSS) VulnerabilityTheme Junkie Team Content
- CVE-2025-53300WordPress Podcast Feed Player Widget and Shortcode plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerabilitydouglaskarr Podcast Feed Player Widget and Shortcode
- CVE-2025-53298WordPress Plugin Inspector plugin <= 1.5 - Arbitrary File Download Vulnerabilitygioni Plugin Inspector
- CVE-2025-53296WordPress EC Stars Rating plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerabilityecoal95 EC Stars Rating
- CVE-2025-53295WordPress iCount Payment Gateway plugin <= 2.0.7 - Broken Access Control VulnerabilityiCount Payment Gateway
- CVE-2025-53294WordPress Smart Agenda plugin <= 4.9 - Cross Site Scripting (XSS) VulnerabilitySmart Agenda
- CVE-2025-53293WordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control VulnerabilityMorten Dalgaard Johansen Dashboard Widget Sidebar
- CVE-2025-53292WordPress WP DataTable plugin <= 0.2.7 - Cross Site Scripting (XSS) Vulnerabilitysamsk WP DataTable
- CVE-2025-53290WordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) VulnerabilityMS WP Visual Sitemap
- CVE-2025-53288WordPress PlatiOnline Payments plugin <= 7.0.0 - Broken Access Control vulnerabilityAdrian Ladó PlatiOnline Payments
- CVE-2025-53287WordPress Quick Favicon plugin <= 0.22.8 - Cross Site Scripting (XSS) VulnerabilityRobert Cummings Quick Favicon
- CVE-2025-53285WordPress Add & Replace Affiliate Links for Amazon plugin <= 1.0.6 - Cross Site Scripting (XSS) VulnerabilityThe Website Flip Add & Replace Affiliate Links for Amazon
- CVE-2025-53284WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerabilitypankaj.sakaria CMS Blocks
- CVE-2025-53282WordPress Thumbnail Editor plugin <= 2.3.3 - Cross Site Scripting (XSS) Vulnerabilityaviplugins.com Thumbnail Editor
- CVE-2025-53280WordPress Football Pool plugin <= 2.12.5 - Cross Site Scripting (XSS) VulnerabilityAntoineH Football Pool
- CVE-2025-53279WordPress Popup addon for Ninja Forms plugin <= 3.4 - Cross Site Scripting (XSS) VulnerabilityAman Popup addon for Ninja Forms
- CVE-2025-53278WordPress WP AdCenter plugin <= 2.6.0 - Cross Site Scripting (XSS) VulnerabilityWPeka WP AdCenter
- CVE-2025-53276WordPress Omnipress plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityomnipressteam Omnipress
- CVE-2025-53275WordPress Leyka plugin <= 3.32.1 - Cross Site Scripting (XSS) vulnerabilityVaultDweller Leyka
- CVE-2025-53273WordPress Slickstream plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) VulnerabilitySlickstream
- CVE-2025-53272WordPress Image Cleanup plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerabilityopicron Image Cleanup
- CVE-2025-53270WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) VulnerabilityBlend Media WordPress CTA
- CVE-2025-53269WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerabilityimw3 My Wp Brand
- CVE-2025-53268WordPress Import external attachments plugin <= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerabilityryanpcmcquen Import external attachments
- CVE-2025-53267WordPress Hide Admin Bar From Front End plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) VulnerabilityAftab Husain Hide Admin Bar From Front End
- CVE-2025-53266WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control VulnerabilityEdwardBock Cron Logger
- CVE-2025-53265WordPress Virusdie plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) VulnerabilityVirusdie
- CVE-2025-53264WordPress ONet Regenerate Thumbnails plugin <= 1.5 - Cross Site Request Forgery (CSRF) VulnerabilityKonrád Koller ONet Regenerate Thumbnails
- CVE-2025-53263WordPress Address Autocomplete via Google for Gravity Forms plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) VulnerabilityPluginsCafe Address Autocomplete via Google for Gravity For…
- CVE-2025-53262WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerabilityWritesonic
- CVE-2025-53261WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerabilitymacbookandrew WP YouTube Live
- CVE-2025-53255WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control VulnerabilityNabil Lemsieh HurryTimer
- CVE-2025-53254WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerabilityThemeisle Cyrlitera
- CVE-2025-53253WordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) VulnerabilityJosh WP Edit
- CVE-2025-53211WordPress Audio Editor & Recorder plugin <= 2.2.3 - Sensitive Data Exposure VulnerabilityRoland Beaussant Audio Editor & Recorder
- CVE-2025-53206WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) VulnerabilityHT Plugins HT Mega – Absolute Addons for WPBakery Page Buil…
- CVE-2025-53203WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) VulnerabilityEDGARROJAS WooCommerce PDF Invoice Builder
- CVE-2025-53202WordPress Responsive Blocks plugin <= 2.0.6 - Cross Site Scripting (XSS) VulnerabilityCyberChimps Responsive Blocks
- CVE-2025-53200WordPress ChatBot plugin <= 6.7.3 - Broken Access Control VulnerabilityQuantumCloud ChatBot
- CVE-2025-53199WordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) VulnerabilityHT Plugins HT Slider For Elementor
- CVE-2025-53197WordPress Cookiebot plugin <= 4.5.8 - Cross Site Request Forgery (CSRF) VulnerabilityCookiebot
- CVE-2025-53193WordPress Burst Statistics plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) VulnerabilityBurst Statistics B.V. Burst Statistics
- CVE-2025-6767sfturing hosp_order DoctorServiceImpl.java findDoctorByCondition sql injectionsfturing hosp_order
- CVE-2025-53018Lychee has Server-Side Request Forgery (SSRF) in Photo::fromUrl API via unvalidated remote image URLsLycheeOrg Lychee
- CVE-2025-6766sfturing hosp_order OfficeServiceImpl.java getOfficeName sql injectionsfturing hosp_order
- CVE-2025-40910Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow…Net-IP-LPM
- CVE-2025-6765Intelbras InControl HTTP PUT Request operador permissionIntelbras InControl
- CVE-2025-32281WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerabilityDarkMySite
- CVE-2025-6762diyhi bbs HTTP Header login getUrl server-side request forgerydiyhi bbs
- CVE-2025-6761Kingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used…Kingdee Cloud-Starry-Sky Enterprise Edition
- CVE-2025-5398Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTIkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2025-5936VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Syncinnate-images-llc VR Calendar
- CVE-2025-5940Osom Blocks <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameterosompress Osom Blocks
- CVE-2025-6550The Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingwebangon The Pack Elementor addon
- CVE-2025-4587A/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingjohnjamesjacoby A/B Testing for WordPress
- CVE-2025-6689FL3R Accessibility Suite <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcodearmandofiore FL3R Accessibility Suite
- CVE-2025-5526BuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/UpdateBuddyPress Docs
- CVE-2025-5194WP Map Block by aBlocks < 2.0.3 - Contributor+ Stored XSS via MarkerWP Map Block
- CVE-2025-5093Responsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSSResponsive Lightbox & Gallery
- CVE-2025-5035Firelight Lightbox < 2.3.16 - Contributor+ Stored XSSFirelight Lightbox
- CVE-2025-41418Buffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD recorders.TB-eye XRN-410SN/TE · TB-eye XRN-810SN/TE +15
- CVE-2025-6488isMobile <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameterjairoochoa isMobile() Shortcode for WordPress
- CVE-2025-6753huija bicycleSharingServer AdminController.java selectAdminByNameLike sql injectionhuija bicycleSharingServer
- CVE-2025-6750HDF5 H5Omtime.c H5O__mtime_new_encode heap-based overflowHDF5
- CVE-2025-6749huija bicycleSharingServer AdminController.java searchAdminMessageShow sql injectionhuija bicycleSharingServer
- CVE-2025-6748Bharti Airtel Thanks App files cleartext storage in a file or on diskBharti Airtel Thanks App
- CVE-2025-6738huija bicycleSharingServer UserServiceImpl.java userDao.selectUserByUserNameLike sql injectionhuija bicycleSharingServer
- CVE-2025-44163RaspAP raspap-webgui 3.3.1 is vulnerable to Directory Traversal in ajax/networking/get_wgkey.php.billz/raspap-webgui
- CVE-2025-44559An issue in the Bluetooth Low Energy (BLE) stack of Realtek RTL8762E BLE SDK v1.4.0 allows attackers within Bluetooth range to cause a…
- CVE-2025-45729D-Link DIR-823-Pro 1.02 has improper permission control, allowing unauthorized users to turn on and access Telnet services.
- CVE-2025-45737An issue in NetEase (Hangzhou) Network Co., Ltd NeacSafe64 Driver before v1.0.0.8 allows attackers to escalate privileges via sending…
- CVE-2025-46415A race condition in the Nix, Lix, and Guix package managers allows the removal of content from arbitrary folders.NixOS Nix
- CVE-2025-46416The Nix, Lix, and Guix package managers allow a bypass of build isolation in which a user can elevate their privileges to the build user…NixOS Nix
- CVE-2025-47818Flock Safety Gunshot Detection devices before 1.3 have a hard-coded password for a connection.Flock Safety Gunshot Detection devices
- CVE-2025-47819Flock Safety Gunshot Detection devices before 1.3 have an on-chip debug interface with improper access control.Flock Safety Gunshot Detection devices
- CVE-2025-47820Flock Safety Gunshot Detection devices before 1.3 have cleartext storage of code.Flock Safety Gunshot Detection devices
- CVE-2025-47821Flock Safety Gunshot Detection devices before 1.3 have a hardcoded password for a system.Flock Safety Gunshot Detection devices
- CVE-2025-47822Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have an on-chip debug interface with improper access control.Flock Safety License Plate Reader
- CVE-2025-47823Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have a hardcoded password for a system.Flock Safety License Plate Reader
- CVE-2025-47824Flock Safety LPR (License Plate Reader) devices with firmware through 2.2 have cleartext storage of code.Flock Safety License Plate Reader
- CVE-2025-50367A stored blind XSS vulnerability exists in the Contact Page of the Phpgurukul Medical Card Generation System 1.0 mcgs/contact.php.
- CVE-2025-50369A Cross-Site Request Forgery (CSRF) vulnerability exists in the Manage Card functionality (/mcgs/admin/manage-card.php) of PHPGurukul…
- CVE-2025-50370A Cross-Site Request Forgery (CSRF) vulnerability exists in the Inquiry Management functionality /mcgs/admin/readenq.php of the Phpgurukul…
- CVE-2025-52991The Nix, Lix, and Guix package managers default to using temporary build directories in a world-readable and world-writable location.NixOS Nix
- CVE-2025-52992The Nix, Lix, and Guix package managers fail to properly set permissions when a derivation build fails.NixOS Nix
- CVE-2025-52993A race condition in the Nix, Lix, and Guix package managers enables changing the ownership of arbitrary files to the UID and GID of the…NixOS Nix