CVEs published April 1, 2025
429 CVEs were published on April 1, 2025: 26 critical, 151 high.
- Published
- 429
- Critical
- 26
- High
- 151
- Medium
- 223
- Low
- 2
- Unrated
- 27
- Now in CISA KEV
- 0
- Fix available
- 65
Most affected products
- Linux
- 93
- Mozilla Firefox · Mozilla Thunderbird
- 7
- JoomSky JS Help Desk
- 5
- MongoDB Server
- 4
- Autodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- 3
- Valmet DNA
- 3
- CodeSolz Ultimate Push Notifications
- 2
- doit Breaking News WP
- 2
- EXEIdeas International WP AutoKeyword
- 2
- Galaxy Weblinks WP Clone any post type
- 2
Critical 26
- CVE-2025-30356Heap Buffer Overflow via Incomplete Length Check in `Crypto_TC_ApplySecurity`nasa CryptoLib
- CVE-2025-31612WordPress CBX Poll plugin <= 2.0.4 - PHP Object Injection vulnerabilitySabuj Kundu CBX Poll
- CVE-2025-31579WordPress WP AutoKeyword plugin <= 1.0 - SQL Injection vulnerabilityEXEIdeas International WP AutoKeyword
- CVE-2025-31553WordPress Advanced WooCommerce Product Sales Reporting plugin <= 4.1.1 - SQL Injection vulnerabilityWPFactory Advanced WooCommerce Product Sales Reporting
- CVE-2025-31552WordPress RSVPMarker plugin <= 11.6.7 - SQL Injection vulnerabilitydavidfcarr RSVPMarker
- CVE-2025-31551WordPress Salesmate Add-On for Gravity Forms plugin <= 2.0.3 - SQL Injection vulnerabilitySalesmate.io Salesmate Add-On for Gravity Forms
- CVE-2025-31534WordPress Shopper plugin <= 3.2.5 - SQL Injection vulnerabilityshopperdotcom Shopper
- CVE-2025-31531WordPress History Log by click5 plugin <= 1.0.13 - SQL Injection vulnerabilityHistory Log by click5
- CVE-2025-30841WordPress Countdown & Clock plugin <=2.8.8 - Remote Code Execution (RCE) vulnerabilityadamskaat Countdown & Clock
- CVE-2025-30807WordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.4 - SQL Injection vulnerabilityMartin Nguyen Next-Cart Store to WooCommerce Migration
- CVE-2025-30580WordPress DigiWidgets Image Editor plugin <= 1.10 - Remote Code Execution (RCE) Vulnerabilitykellydiek DigiWidgets Image Editor
- CVE-2025-3096Clinics Patient Management System SQL InjectionSourceCodester Clinic's Patient Management System
- CVE-2025-21954netmem: prevent TX of unreadable skbsLinux
- CVE-2025-21927nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu()Linux
- CVE-2025-2237WP RealEstate <= 1.6.26 - Unauthenticated Privilege Escalation via 'process_register'ApusThemes WP RealEstate
- CVE-2024-13553SMS Alert Order Notifications – WooCommerce <= 3.7.9 - Unauthenticated Account Takeover/Privilege Escalationcozyvision1 SMS Alert – SMS & OTP for WooCommerce, Order No…
- CVE-2024-56325Apache Pinot: Authentication bypass issue. If the path does not contain / and contain . authentication is not requiredApache Software Foundation Apache Pinot · org.apache.pin… +2
- CVE-2025-30065Apache Parquet Java: Arbitrary code execution in the parquet-avro module when reading an Avro schema from a Parquet file metadataApache Software Foundation Apache Parquet Java · org.apache…
- CVE-2025-30971WordPress XV Random Quotes plugin <= 2.0.0 - SQL Injection vulnerabilityXavi Ivars XV Random Quotes
- CVE-2025-31095WordPress Material Dashboard plugin <= 1.4.5 - Privilege Escalation VulnerabilityHossein Material Dashboard
- CVE-2025-31087WordPress Multiple Shipping And Billing Address For Woocommerce plugin <= 1.5 - PHP Object Injection Vulnerabilitysilverplugins217 Multiple Shipping And Billing Address For…
- CVE-2025-31084WordPress Sunshine Photo Cart plugin <= 3.4.10 - PHP Object Injection Vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2025-30911WordPress RomethemeKit For Elementor plugin <= 1.5.4 - Arbitrary Plugin Installation/Activation to RCE vulnerabilityRometheme RTMKit
- CVE-2025-30886WordPress JS Help Desk plugin <= 2.9.2 - SQL Injection vulnerabilityJoomSky JS Help Desk
- CVE-2025-30876WordPress Ads by WPQuads plugin <= 2.0.87.1 - SQL Injection VulnerabilityAds by WPQuads
- CVE-2025-30622WordPress PostMash plugin <= 1.0.3 - SQL Injection Vulnerabilitytorsteino PostMash
High 151
- CVE-2025-31619WordPress Actionwear products sync plugin <= 2.3.3 - SQL Injection vulnerabilitymarcoingraiti Actionwear products sync
- CVE-2025-31594WordPress Auto scroll for reading plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWPglob Auto scroll for reading
- CVE-2025-31580WordPress Ni WooCommerce Product Enquiry plugin <= 4.1.8 - Broken Access Control vulnerabilityAnzar Ahmed Ni WooCommerce Product Enquiry
- CVE-2025-31578WordPress Fonts Manager | Custom Fonts plugin <= 1.2 - Cross Site Scripting (XSS) vulnerabilityWisdomlogix Solutions Pvt. Fonts Manager | Custom Fonts
- CVE-2025-31571WordPress The Logo Slider plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityCynob IT Consultancy The Logo Slider
- CVE-2025-31568WordPress LeadLab by wiredminds plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitywiredmindshelp LeadLab by wiredminds
- CVE-2025-31564WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.2.6 - SQL Injection vulnerabilityaitool Ai Auto Tool Content Writing Assistant (Gemini Write…
- CVE-2025-31563WordPress AI Search Bar plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityVimal Kava AI Search Bar
- CVE-2025-31561WordPress Ultimate Push Notifications plugin <= 1.2.0 - SQL Injection vulnerabilityCodeSolz Ultimate Push Notifications
- CVE-2025-31560WordPress Salon booking system plugin < 10.15 - Privilege Escalation vulnerabilityDimitri Grassi Salon booking system
- CVE-2025-31548WordPress Ultimate Push Notifications plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityCodeSolz Ultimate Push Notifications
- CVE-2025-31537WordPress Bulk NoIndex & NoFollow Toolkit plugin <= 2.16 - Reflected Cross Site Scripting (XSS) vulnerabilitymadfishdigital Bulk NoIndex & NoFollow Toolkit
- CVE-2025-31462WordPress CGM Event Calendar plugin <= 0.8.5 - Cross Site Scripting (XSS) Vulnerabilityrzfarrell CGM Event Calendar
- CVE-2025-31461WordPress NanoSupport plugin <= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMayeenul Islam NanoSupport
- CVE-2025-31455WordPress Limit Max IPs Per User plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityralxz Limit Max IPs Per User
- CVE-2025-31454WordPress Delete Post Revision plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityArefly Delete Post Revision
- CVE-2025-31446WordPress WP Cleaner plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityjiangmiao WP Cleaner
- CVE-2025-31445WordPress Pages Order plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilitySed Lex Pages Order
- CVE-2025-31441WordPress WordPress Galleria plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWordPress Galleria
- CVE-2025-31431WordPress WP Bookmarks plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilityconlabz WP Bookmarks
- CVE-2025-31097WordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion VulnerabilityHossein Material Dashboard
- CVE-2025-31089WordPress Order Splitter for WooCommerce plugin <= 5.3.0 - SQL Injection VulnerabilityFahad Mahmood Order Splitter for WooCommerce
- CVE-2025-31086WordPress Product Table by WBW plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerabilityWBW Plugins Product Table by WBW
- CVE-2025-31085WordPress xili-language plugin <= 2.21.2 - Reflected Cross Site Scripting (XSS) vulnerabilityMichel - xiligroup dev xili-language
- CVE-2025-31082WordPress News & Blog Designer Pack plugin <= 4.0 - Local File Inclusion vulnerabilityInfornWeb News & Blog Designer Pack
- CVE-2025-31081WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityShortPixel Enable Media Replace
- CVE-2025-31080WordPress HTML Forms plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityLink Software HTML Forms
- CVE-2025-31078WordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.18 - Reflected Cross Site Scripting (XSS) vulnerabilityenituretechnology Small Package Quotes – Worldwide Express…
- CVE-2025-30913WordPress Access Areas Plugin <= 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerabilitypodpirate Access Areas
- CVE-2025-30906WordPress Plugin Oficial – Getnet para WooCommerce plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerabilitylisandragetnet Plugin Oficial – Getnet para WooCommerce
- CVE-2025-30905WordPress Secure Copy Content Protection and Content Locking plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerabilityAys Pro Secure Copy Content Protection and Content Locking
- CVE-2025-30892WordPress WpTravelly Plugin <= 1.8.7 - PHP Object Injection vulnerabilitymagepeopleteam WpTravelly
- CVE-2025-30852WordPress Oracle Cards Lite plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) Vulnerabilityemotionalonlinestorytelling Oracle Cards Lite
- CVE-2025-30844WordPress Watu Quiz plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) VulnerabilityBob Watu Quiz
- CVE-2025-30825WordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerabilityWPClever WPC Smart Linked Products - Upsells & Cross-sells…
- CVE-2025-30778WordPress VForm plugin <= 3.1.9 - Reflected Cross Site Scripting (XSS) vulnerabilityVikas Ratudi VPSUForm
- CVE-2025-30554WordPress Frizzly plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityAbhishek Kumar Frizzly
- CVE-2025-31137Remix and React Router allow URL manipulation via Host / X-Forwarded-Host headersremix-run react-router · @react-router/express +1
- CVE-2025-21985drm/amd/display: Fix out-of-bound accessesLinux
- CVE-2025-21984mm: fix kernel BUG when userfaultfd_move encounters swapcacheLinux
- CVE-2025-21979wifi: cfg80211: cancel wiphy_work before freeing wiphyLinux
- CVE-2025-21976fbdev: hyperv_fb: Allow graceful removal of framebufferLinux
- CVE-2025-21972net: mctp: unshare packets when reassemblingLinux
- CVE-2025-21971net_sched: Prevent creation of classes with TC_H_ROOTLinux
- CVE-2025-21970net/mlx5: Bridge, fix the crash caused by LAG state checkLinux
- CVE-2025-21969Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmdLinux
- CVE-2025-21968drm/amd/display: Fix slab-use-after-free on hdcp_workLinux
- CVE-2025-21967ksmbd: fix use-after-free in ksmbd_free_work_structLinux
- CVE-2025-21966dm-flakey: Fix memory corruption in optional corrupt_bio_byte featureLinux
- CVE-2025-21965sched_ext: Validate prev_cpu in scx_bpf_select_cpu_dfl()Linux
- CVE-2025-21961eth: bnxt: fix truesize for mb-xdp-pass caseLinux
- CVE-2025-21960eth: bnxt: do not update checksum in bnxt_xdp_build_skb()Linux
- CVE-2025-21959netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree()Linux
- CVE-2025-21958Revert "openvswitch: switch to per-action label counting in conntrack"Linux
- CVE-2025-21955ksmbd: prevent connection release during oplock break notificationLinux
- CVE-2025-21949LoongArch: Set hugetlb mmap base address aligned with pmd sizeLinux
- CVE-2025-21947ksmbd: fix type confusion via race condition when using ipc_msg_send_requestLinux
- CVE-2025-21946ksmbd: fix out-of-bounds in parse_sec_desc()Linux
- CVE-2025-21945ksmbd: fix use-after-free in smb2_lockLinux
- CVE-2025-21939drm/xe/hmm: Don't dereference struct page pointers without notifier lockLinux
- CVE-2025-21938mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addrLinux
- CVE-2025-21934rapidio: fix an API misues when rio_add_net() failsLinux
- CVE-2025-21932mm: abort vma_modify() on merge out of memory failureLinux
- CVE-2025-21929HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove()Linux
- CVE-2025-21928HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()Linux
- CVE-2025-21926net: gso: fix ownership in __udp_gso_segmentLinux
- CVE-2025-21924net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an errorLinux
- CVE-2025-21923HID: hid-steam: Fix use-after-free when detaching deviceLinux
- CVE-2025-21920vlan: enforce underlying device typeLinux
- CVE-2025-21919sched/fair: Fix potential memory corruption in child_cfs_rq_on_listLinux
- CVE-2025-21915cdx: Fix possible UAF error in driver_override_show()Linux
- CVE-2025-21914slimbus: messaging: Free transaction ID in delayed interrupt scenarioLinux
- CVE-2025-21906wifi: iwlwifi: mvm: clean up ROC on failureLinux
- CVE-2025-21905wifi: iwlwifi: limit printed string from FW fileLinux
- CVE-2025-21901RDMA/bnxt_re: Add sanity checks on rdev validityLinux
- CVE-2025-21900NFSv4: Fix a deadlock when recovering state on a sillyrenamed fileLinux
- CVE-2025-21899tracing: Fix bad hist from corrupting named_triggers listLinux
- CVE-2025-21896fuse: revert back to __readahead_folio() for readaheadLinux
- CVE-2025-31132Raven allows Remote Code Execution due to improper validationThe-Commit-Company raven
- CVE-2025-31131Path Traversal allowing arbitrary read of files in Yeswikiyeswiki · yeswiki/yeswiki
- CVE-2025-31121OpenEMR allows XSS in Patient Image featureopenemr
- CVE-2025-31910WordPress BookingPress plugin <= 1.1.28 - SQL Injection vulnerabilityreputeinfosystems BookingPress
- CVE-2025-31908WordPress JSON Structuring Markup plugin <= 0.1 - CSRF to Stored XSS vulnerabilitySami Ahmed Siddiqui JSON Structuring Markup
- CVE-2025-31906WordPress WP Profitshare Plugin <= 1.4.9 - CSRF to Stored XSS vulnerabilityProfitShare.ro WP Profitshare
- CVE-2025-31904WordPress Ebook Downloader plugin <= 1.0 - CSRF to Stored XSS vulnerabilityInfoway Ebook Downloader
- CVE-2025-30354Bruno ignores Safe-Mode in Asserts expressionsusebruno bruno
- CVE-2025-30210Bruno XSS On Environment Nameusebruno bruno
- CVE-2025-22231VMware Aria Operations updates address a local privilege escalation vulnerability (CVE-2025-22231)VMware Aria operations
- CVE-2025-1660DWFX File Parsing Memory Corruption VulnerabilityAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2025-3034Memory safety bugs fixed in Firefox 137 and Thunderbird 137Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-3033Opening local .url files could lead to another file being openedMozilla Firefox · Mozilla Thunderbird
- CVE-2025-3032Leaking file descriptors from the fork serverMozilla Firefox · Mozilla Thunderbird
- CVE-2025-3030Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-3029URL Bar Spoofing via non-BMP Unicode charactersMozilla Firefox · Mozilla Thunderbird
- CVE-2025-1659DWFX File Parsing Out-of-Bounds Read VulnerabilityAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2025-1658DWFX File Parsing Out-of-Bounds Read VulnerabilityAutodesk Navisworks Freedom · Autodesk Navisworks Simula… +1
- CVE-2025-3085MongoDB Server running on Linux may allow unexpected connections where intermediate certificates are revokedMongoDB Server
- CVE-2025-3083Malformed MongoDB wire protocol messages may cause mongos to crashMongoDB Server
- CVE-2025-2891WP Pro Real Estate 7 <= 3.5.4 - Authenticated (Custom) Arbitrary File Uploadcontempoinc Real Estate 7 WordPress
- CVE-2024-12278Booster for WooCommerce <= 7.2.4 - Unauthenticated Stored Cross-Site Scriptingpluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2025-31024WordPress RJ Quickcharts plugin <= 0.6.1 - SQL Injection vulnerabilityrandyjensen RJ Quickcharts
- CVE-2025-31001WordPress GTM Kit plugin <= 2.4.0 - Sensitive Data Exposure vulnerabilityTLA Media GTM Kit
- CVE-2025-22277WordPress Vitepos plugin <= 3.1.4 - Broken Authentication vulnerabilityappsbd Vitepos
- CVE-2025-31415WordPress YayExtra <= 1.5.2 - Broken Access Control VulnerabilityYayCommerce YayExtra
- CVE-2025-31074WordPress MDJM Event Management plugin <= 1.7.5.2 - PHP Object Injection vulnerabilityMDJM Mobile DJ Manager
- CVE-2025-30924WordPress Primer MyData for Woocommerce plugin < 4.2.4 - Reflected Cross Site Scripting (XSS) vulnerabilityprimersoftware Primer MyData for Woocommerce
- CVE-2025-30917WordPress SKU Generator for WooCommerce plugin <= 1.6.2 - Reflected Cross Site Scripting (XSS) VulnerabilityWP Wham SKU Generator for WooCommerce
- CVE-2025-30910WordPress CM Download Manager plugin <= 2.9.6 - Arbitrary File Deletion vulnerabilityCreativeMindsSolutions CM Download Manager
- CVE-2025-30902WordPress AEC Kiosque plugin <= 1.9.3 - Reflected Cross Site Scripting (XSS) vulnerabilityATL Software SRL AEC Kiosque
- CVE-2025-30901WordPress JS Help Desk plugin <= 2.9.2 - Local File Inclusion vulnerabilityJoomSky JS Help Desk
- CVE-2025-30882WordPress JS Help Desk plugin <= 2.9.1 - Arbitrary File Download vulnerabilityJoomSky JS Help Desk
- CVE-2025-30880WordPress JS Help Desk plugin <= 2.9.2 - Broken Access Control vulnerabilityJoomSky JS Help Desk
- CVE-2025-30878WordPress JS Help Desk plugin <= 2.9.2 - Arbitrary File Deletion vulnerabilityJoomSky JS Help Desk
- CVE-2025-30870WordPress WP Travel Engine plugin <= 6.3.5 - Local File Inclusion vulnerabilityWP Travel Engine
- CVE-2025-30869WordPress Image Wall plugin <= 3.0 - Cross Site Scripting (XSS) VulnerabilityParakoos Image Wall
- CVE-2025-30849WordPress Essential Real Estate plugin <= 5.2.0 - Local File Inclusion Vulnerabilityg5theme Essential Real Estate
- CVE-2025-30848WordPress Hostel plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityBob Hostel
- CVE-2025-30840WordPress xili-dictionary plugin <= 2.12.5 - Reflected Cross Site Scripting (XSS) vulnerabilityMichel - xiligroup dev xili-dictionary
- CVE-2025-30837WordPress WooCommerce Fattureincloud plugin <= 2.6.7 - Cross Site Scripting (XSS) vulnerabilityCristiano Zanca WooCommerce Fattureincloud
- CVE-2025-30834WordPress Bit Assist plugin <= 1.5.4 - Path Traversal vulnerabilityBit Apps Bit Assist
- CVE-2025-30827WordPress WP2LEADS plugin <= 3.4.5 - Reflected Cross Site Scripting (XSS) vulnerabilitySaleswonder Team: Tobias WP2LEADS
- CVE-2025-30808WordPress About Author plugin <= 1.6.2 - Reflected Cross Site Scripting (XSS) vulnerabilityWeblizar - WordPress Themes & Plugin About Author
- CVE-2025-30798WordPress Better WishList API plugin <= 1.1.4 - Cross Site Scripting (XSS) Vulnerabilityrickonline_nl Better WishList API
- CVE-2025-30797WordPress Greek Multi Tool – Fix peralinks, accents, auto create menus and more plugin <= 2.3.1 - Broken Access Control Vulnerabilitybigdrop.gr Greek Multi Tool – Fix peralinks, accents, auto…
- CVE-2025-30796WordPress The Ultimate WordPress Toolkit – WP Extended plugin <= 3.0.14 - Cross Site Scripting (XSS) vulnerabilityThe Ultimate WordPress Toolkit – WP Extended
- CVE-2025-30794WordPress Event Tickets plugin <= 5.20.0 - Reflected Cross Site Scripting (XSS) vulnerabilityStellarWP Event Tickets
- CVE-2025-30793WordPress Houzez Property Feed plugin <= 2.5.4 - Arbitrary File Download VulnerabilityProperty Hive Houzez Property Feed
- CVE-2025-30782WordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion vulnerabilityWP Shuffle Subscribe to Download Lite
- CVE-2025-30774WordPress Quiz Maker plugin <= 6.6.8.7 - SQL Injection vulnerabilityAys Pro Quiz Maker
- CVE-2025-30614WordPress Google Font Fix plugin <= 2.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityHaozhe Xie Google Font Fix
- CVE-2025-30607WordPress Quick Localization plugin <= 0.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityName.ly Quick Localization
- CVE-2025-30589WordPress Flickr set slideshows plugin <= 0.9 - SQL Injection VulnerabilityDourou Flickr set slideshows
- CVE-2025-30579WordPress Pesapal Gateway for Woocommerce plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityJakeii Pesapal Gateway for Woocommerce
- CVE-2025-30563WordPress Tidekey plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitymakong Tidekey
- CVE-2025-30559WordPress Kento WordPress Stats plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityPluginsPoint Kento WordPress Stats
- CVE-2025-30548WordPress Advanced Post Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityVarDump s.r.l. Advanced Post Search
- CVE-2025-30547WordPress WP Cards plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilityDavid Tufts WP Cards
- CVE-2025-30544WordPress OK Poster Group plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerabilitysvmidi OK Poster Group
- CVE-2025-30520WordPress Breezing Forms plugin <= 1.2.8.11 - Reflected Cross Site Scripting (XSS) vulnerabilitycrosstec Breezing Forms
- CVE-2024-13567Awesome Support – WordPress HelpDesk & Support Plugin <= 6.3.1 - Unauthenticated Sensitive Information Exposure Through Unprotected Directoryawesomesupport Awesome Support – WordPress HelpDesk & Suppo…
- CVE-2025-2008Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Uploadsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2025-2007Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletionsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2025-0416Valmet DNA Local privilege escalation through insecure DCOM configurationValmet DNA
- CVE-2025-0417Valmet DNA Lack of protection against brute force attacksValmet DNA
- CVE-2025-21384Azure Health Bot Elevation of Privilege VulnerabilityMicrosoft Azure Health Bot
- CVE-2025-27829An issue was discovered in Stormshield Network Security (SNS) 4.3.x before 4.3.35.
- CVE-2025-28395D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter.
- CVE-2025-28398D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter.
- CVE-2025-29033An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET par
- CVE-2025-29069A heap buffer overflow vulnerability has been identified in the lcms2-2.16.
- CVE-2025-29070A heap buffer overflow vulnerability has been identified in thesmooth2() in cmsgamma.c in lcms2-2.16 which allows a remote attacker to cause
Medium, low and unrated 252
- CVE-2025-31135Go-Guerrilla SMTP Daemon allows the PROXY command to be sent multiple timesphires go-guerrilla · github.com/phires/go-guerrilla
- CVE-2024-13941ouch-org ouch zip.rs convert_zip_date_time memory corruptionouch-org ouch · ouch
- CVE-2025-31889WordPress Extensions for Elementor plugin <= 2.0.40 - Cross Site Scripting (XSS) vulnerabilitypetesheppard84 Extensions for Elementor
- CVE-2025-31819WordPress Nova Blocks by Pixelgrade plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilitypixelgrade Nova Blocks
- CVE-2025-31628WordPress Sliced Invoices plugin <= 3.10.0 - Insecure Direct Object References (IDOR) vulnerabilitySlicedInvoices Sliced Invoices
- CVE-2025-31550WordPress WP-LESS plugin <= 1.9.6 - Sensitive Data Exposure vulnerabilitythom4 WP-LESS
- CVE-2025-31525WordPress WP Mobile Bottom Menu plugin <= 1.4.0 - Broken Access Control vulnerabilityWP Messiah WP Mobile Bottom Menu
- CVE-2025-30853WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerabilityShortPixel Adaptive Images
- CVE-2025-31753WordPress Advanced Speed Increaser Plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityAnimesh Kumar Advanced Speed Increaser
- CVE-2025-25041Arbitrary File Overwrite in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows ClientHewlett Packard Enterprise (HPE) Virtual Intranet Access
- CVE-2025-21986net: switchdev: Convert blocking notification chain to a raw oneLinux
- CVE-2025-21983mm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wqLinux
- CVE-2025-21982pinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fwLinux
- CVE-2025-21981ice: fix memory leak in aRFS after resetLinux
- CVE-2025-21980sched: address a potential NULL pointer dereference in the GRED scheduler.Linux
- CVE-2025-21978drm/hyperv: Fix address space leak when Hyper-V DRM device is removedLinux
- CVE-2025-21977fbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMsLinux
- CVE-2025-21975net/mlx5: handle errors in mlx5_chains_create_table()Linux
- CVE-2025-21974eth: bnxt: return fail if interface is down in bnxt_queue_mem_alloc()Linux
- CVE-2025-21973eth: bnxt: fix kernel panic in the bnxt_get_queue_stats{rx | tx}Linux
- CVE-2025-21964cifs: Fix integer overflow while processing acregmax mount optionLinux
- CVE-2025-21963cifs: Fix integer overflow while processing acdirmax mount optionLinux
- CVE-2025-21962cifs: Fix integer overflow while processing closetimeo mount optionLinux
- CVE-2025-21957scsi: qla1280: Fix kernel oops when debug level > 2Linux
- CVE-2025-21956drm/amd/display: Assign normalized_pix_clk when color depth = 14Linux
- CVE-2025-21953net: mana: cleanup mana struct after debugfs_remove()Linux
- CVE-2025-21952HID: corsair-void: Update power supply values with a unified work handlerLinux
- CVE-2025-21951bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlockLinux
- CVE-2025-21950drivers: virt: acrn: hsm: Use kzalloc to avoid info leak in pmcmd_ioctlLinux
- CVE-2025-21948HID: appleir: Fix potential NULL dereference at raw event handleLinux
- CVE-2025-21944ksmbd: fix bug on trap in smb2_lockLinux
- CVE-2025-21943gpio: aggregator: protect driver attr handlers against module unloadLinux
- CVE-2025-21942btrfs: zoned: fix extent range end unlock in cow_file_range()Linux
- CVE-2025-21941drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_paramsLinux
- CVE-2025-21940drm/amdkfd: Fix NULL Pointer Dereference in KFD queueLinux
- CVE-2025-21937Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()Linux
- CVE-2025-21936Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected()Linux
- CVE-2025-21935rapidio: add check for rio_add_net() in rio_scan_alloc_net()Linux
- CVE-2025-21933arm: pgtable: fix NULL pointer dereference issueLinux
- CVE-2025-21931hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folioLinux
- CVE-2025-21930wifi: iwlwifi: mvm: don't try to talk to a dead firmwareLinux
- CVE-2025-21925llc: do not use skb_get() before dev_queue_xmit()Linux
- CVE-2025-21922ppp: Fix KMSAN uninit-value warning with bpfLinux
- CVE-2025-21921net: ethtool: netlink: Allow NULL nlattrs when getting a phy_deviceLinux
- CVE-2025-21918usb: typec: ucsi: Fix NULL pointer accessLinux
- CVE-2025-21917usb: renesas_usbhs: Flush the notify_hotplug_workLinux
- CVE-2025-21916usb: atm: cxacru: fix a flaw in existing endpoint checksLinux
- CVE-2025-21913x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range()Linux
- CVE-2025-21912gpio: rcar: Use raw_spinlock to protect register accessLinux
- CVE-2025-21911drm/imagination: avoid deadlock on fence releaseLinux
- CVE-2025-21910wifi: cfg80211: regulatory: improve invalid hints checkingLinux
- CVE-2025-21909wifi: nl80211: reject cooked mode if it is set along with other flagsLinux
- CVE-2025-21908NFS: fix nfs_release_folio() to not deadlock via kcompactd writebackLinux
- CVE-2025-21907mm: memory-failure: update ttu flag inside unmap_poisoned_folioLinux
- CVE-2025-21904caif_virtio: fix wrong pointer check in cfv_probe()Linux
- CVE-2025-21903mctp i3c: handle NULL header addressLinux
- CVE-2025-21902acpi: typec: ucsi: Introduce a ->poll_cci methodLinux
- CVE-2025-21898ftrace: Avoid potential division by zero in function_stat_show()Linux
- CVE-2025-21897sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()Linux
- CVE-2025-21895perf/core: Order the PMU list to fix warning about unordered pmu_ctx_listLinux
- CVE-2025-21894net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNCLinux
- CVE-2025-31897WordPress Arrow Custom Feed for Twitter plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerabilityArrow Plugins Arrow Custom Feed for Twitter
- CVE-2025-31895WordPress ABC Notation Plugin <= 6.1.3 - Cross Site Scripting (XSS) vulnerabilitypaulrosen ABC Notation
- CVE-2025-31894WordPress Ebook Downloader plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityInfoway Ebook Downloader
- CVE-2025-31892WordPress WP Crowdfunding plugin <= 2.1.15 - Cross Site Scripting (XSS) vulnerabilityThemeum WP Crowdfunding
- CVE-2025-31891WordPress Gosign – Posts Slider Block plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilityGosign – Posts Slider Block
- CVE-2025-31890WordPress Simple Map No Api plugin <= 1.9 - Cross Site Scripting (XSS) vulnerabilityMashi Simple Map No Api
- CVE-2025-31888WordPress WP Multi Store Locator Plugin <= 2.5.2 - Cross Site Request Forgery (CSRF) vulnerabilityWPExperts.io WP Multistore Locator
- CVE-2025-31887WordPress MyBookProgress plugin <= 1.0.8 - Broken Access Control vulnerabilityzookatron MyBookProgress by Stormhill Media
- CVE-2025-31886WordPress Social proof testimonials and reviews by Repuso plugin <= 5.21 - Broken Access Control vulnerabilitySocial proof testimonials and reviews by Repuso
- CVE-2025-31885WordPress Hyperlink Group Block plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityDaniel Floeter Hyperlink Group Block
- CVE-2025-31884WordPress Norse Rune Oracle Plugin plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityWP CMS Ninja Norse Rune Oracle Plugin
- CVE-2025-31883WordPress WebinarPress plugin <= 1.33.28 - Cross Site Scripting (XSS) vulnerabilityWPWebinarSystem WebinarPress
- CVE-2025-31882WordPress Webinar Plugin <= 1.33.28 - Broken Access Control vulnerabilityWPWebinarSystem WebinarPress
- CVE-2025-31881WordPress Pearl plugin <= 1.3.9 - Broken Access Control vulnerabilityStylemix Pearl
- CVE-2025-31880WordPress Pearl plugin <= 1.3.9 - Cross Site Request Forgery (CSRF) vulnerabilityStylemix Pearl
- CVE-2025-31879WordPress Barcode Generator for WooCommerce plugin <= 2.0.4 - Settings Change vulnerabilityDmitry V. (CEO of "UKR Solution") Barcode Generator for Woo…
- CVE-2025-31878WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Settings Change vulnerabilityDmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generat…
- CVE-2025-31877WordPress RestroPress plugin <= 3.2.8 - Broken Access Control vulnerabilityMagnigenie RestroPress
- CVE-2025-31875WordPress FancyPost plugin <= 6.0.1 - Cross Site Scripting (XSS) vulnerabilityPluginic FancyPost
- CVE-2025-31874WordPress WebberZone Snippetz plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerabilityAjay WebberZone Snippetz
- CVE-2025-31873WordPress SheetDB plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilitySheetDB
- CVE-2025-31872WordPress WP Clone any post type Plugin <= 3.6 - Broken Access Control vulnerabilityGalaxy Weblinks WP Clone any post type
- CVE-2025-31871WordPress WP Clone any post type Plugin <= 3.6 - Open Redirect vulnerabilityGalaxy Weblinks WP Clone any post type
- CVE-2025-31870WordPress WP AutoKeyword plugin <= 1.0 - Arbitrary Content Deletion vulnerabilityEXEIdeas International WP AutoKeyword
- CVE-2025-31869WordPress Black Widgets For Elementor plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerabilityModernaweb Studio Black Widgets For Elementor
- CVE-2025-31868WordPress JS Job Manager plugin <= 2.0.2 - Broken Access Control vulnerabilityJoomSky JS Job Manager
- CVE-2025-31867WordPress JS Job Manager Plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerabilityJoomSky JS Job Manager
- CVE-2025-31866WordPress ShipDepot for WooCommerce plugin <= 1.2.19 - Broken Access Control vulnerabilityShip Depot ShipDepot for WooCommerce
- CVE-2025-31865WordPress CartBoss plugin <= 4.1.2 - Broken Access Control vulnerabilityCartBoss
- CVE-2025-31864WordPress Beam me up Scotty – Back to Top Button plugin <= 1.0.23 - Cross Site Scripting (XSS) vulnerabilityOut the Box Beam me up Scotty
- CVE-2025-31863WordPress Agency Toolkit plugin <= 1.0.24 - Broken Access Control vulnerabilityinspry Agency Toolkit
- CVE-2025-31862WordPress Job Board Manager Plugin <= 2.1.61 - Broken Access Control vulnerabilityPickPlugins Job Board Manager
- CVE-2025-31861WordPress Perfect Font Awesome Integration Plugin <= 2.3 - Stored Cross Site Scripting (XSS) vulnerabilityWPOrbit Support Perfect Font Awesome Integration
- CVE-2025-31860WordPress WP AdCenter plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerabilityWPeka WP AdCenter
- CVE-2025-31859WordPress Feedbucket – Website Feedback Tool Plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerabilityFeedbucket – Website Feedback Tool
- CVE-2025-31857WordPress Directorist AddonsKit for Elementor plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerabilitywpWax Directorist AddonsKit for Elementor
- CVE-2025-31856WordPress Export All Post Meta Plugin <= 1.2.1 - Broken Access Control vulnerabilitybrainvireinfo Export All Post Meta
- CVE-2025-31855WordPress SMM API plugin <= 6.0.31 - Cross Site Scripting (XSS) vulnerabilitysoftnwords SMM API
- CVE-2025-31854WordPress Simple Sticky Add To Cart For WooCommerce plugin <= 1.4.9 - Broken Access Control vulnerabilitySharaz Shahid Simple Sticky Add To Cart For WooCommerce
- CVE-2025-31853WordPress Smartarget Popup Plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityErez Hadas-Sonnenschein Smartarget Popup
- CVE-2025-31852WordPress Bulk Product Sync plugin <= 8.6 - Cross Site Request Forgery (CSRF) vulnerabilityN-Media Bulk Product Sync
- CVE-2025-31851WordPress Beds24 Online Booking plugin <= 2.0.27 - Cross Site Scripting (XSS) vulnerabilitymarkkinchin Beds24 Online Booking
- CVE-2025-31850WordPress PDF Generator Addon for Elementor Page Builder plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerabilityRedefiningTheWeb PDF Generator Addon for Elementor Page Bui…
- CVE-2025-31849WordPress Nemesis All-in-One plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityfbtemplates Nemesis All-in-One
- CVE-2025-31848WordPress WordPress Adverts Plugin plugin <= 1.4 - Broken Access Control vulnerabilityWPFactory Adverts
- CVE-2025-31847WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilitythemelooks mFolio Lite
- CVE-2025-31846WordPress Theater for WordPress plugin <= 0.18.7 - Broken Access Control vulnerabilityJeroen Schmit Theater for WordPress
- CVE-2025-31845WordPress Theme Duplicator Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerabilityRohit Choudhary Theme Duplicator
- CVE-2025-31844WordPress Magical Blocks plugin <= 1.0.12 - Cross Site Scripting (XSS) vulnerabilityNoor Alam Magical Blocks
- CVE-2025-31843WordPress OpenAI Tools for WordPress & WooCommerce plugin <= 2.2.1 - Broken Access Control vulnerabilityWilson OpenAI Tools for WordPress & WooCommerce
- CVE-2025-31842WordPress Viral Loops WP Integration Plugin <= 3.4.0 - Sensitive Data Exposure vulnerabilityviralloops Viral Loops WP Integration
- CVE-2025-31840WordPress Simple Fixed Notice Plugin <= 1.6 - Cross Site Request Forgery (CSRF) vulnerabilitydigireturn Simple Fixed Notice
- CVE-2025-31839WordPress Footer Contacts Bar plugin <= 1.8 - Cross Site Request Forgery (CSRF) vulnerabilitydigireturn DN Footer Contacts
- CVE-2025-31838WordPress Eventbee RSVP Widget plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityEventbee RSVP Widget
- CVE-2025-31837WordPress WP Proposals plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityWP Codeus WP Proposals
- CVE-2025-31836WordPress Review Manager plugin <= 2.5.0 - Broken Access Control vulnerabilitymatthewrubin Review Manager
- CVE-2025-31835WordPress WP Plugin Info Card plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerabilityBrice Capobianco WP Plugin Info Card
- CVE-2025-31834WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Broken Access Control vulnerabilitythemeglow JobBoard Job listing
- CVE-2025-31833WordPress JobBoard Job listing plugin Plugin <= 1.2.8 - Insecure Direct Object References (IDOR) vulnerabilitythemeglow JobBoard Job listing
- CVE-2025-31832WordPress ACF City Selector plugin <= 1.17.0 - Sensitive Data Exposure vulnerabilityBeee ACF City Selector
- CVE-2025-31831WordPress AtomChat plugin <= 1.1.7 - Broken Access Control vulnerabilityTeam AtomChat AtomChat
- CVE-2025-31830WordPress Printus Plugin <= 1.2.6 - Broken Access Control vulnerabilityUriahs Victor Printus
- CVE-2025-31829WordPress ShopCred plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitydevscred ShopCred
- CVE-2025-31828WordPress Easy!Appointments plugin <= 1.4.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityalextselegidis Easy!Appointments
- CVE-2025-31826WordPress Ni WooCommerce Cost Of Goods plugin <= 3.2.8 - Broken Access Control vulnerabilityAnzar Ahmed Ni WooCommerce Cost Of Goods
- CVE-2025-31824WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerabilityWombat Plugins WP Optin Wheel
- CVE-2025-31823WordPress WPoperation Elementor Addons plugin 1.1.9 - Cross Site Scripting (XSS) vulnerabilitywpoperations WPoperation Elementor Addons
- CVE-2025-31822WordPress WordPress Simple HTML Sitemap plugin <= 3.4 - Broken Access Control vulnerabilityAshish Ajani WP Simple HTML Sitemap
- CVE-2025-31821WordPress Integration of Zoho CRM and Contact Form 7 plugin <= 1.0.6 - Open Redirection Vulnerabilityformsintegrations Integration of Zoho CRM and Contact Form
- CVE-2025-31820WordPress Automatic Featured Images from Videos plugin <= 1.2.4 - Broken Access Control vulnerabilitywebdevstudios Automatic Featured Images from Videos
- CVE-2025-31818WordPress ContentBot AI Writer plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerabilityContentBot.ai ContentBot AI Writer
- CVE-2025-31817WordPress BlockWheels plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityWPWheels BlockWheels
- CVE-2025-31816WordPress Mobile App Canvas Plugin <= 3.8.2 - Broken Access Control vulnerabilitypietro Mobile App Canvas
- CVE-2025-31815WordPress Design Blocks plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerabilitydevscred Design Blocks
- CVE-2025-31814WordPress OwnerRez Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityOwnerRez API
- CVE-2025-31813WordPress WPSHARE247 Elementor Addons plugin <= 2.5 - Cross Site Scripting (XSS) vulnerabilityWebsite366.com WPSHARE247 Elementor Addons
- CVE-2025-31812WordPress BuddyPress Members Only plugin <= 3.5.3 - Cross Site Scripting (XSS) vulnerabilityTomas BuddyPress Members Only
- CVE-2025-31811WordPress Planyo online reservation system plugin <= 3.1 - Cross Site Scripting (XSS) vulnerabilityxtreeme Planyo online reservation system
- CVE-2025-31810WordPress Question Answer plugin <= 1.2.73 - Broken Access Control vulnerabilityPickPlugins Question Answer
- CVE-2025-31809WordPress Labinator Content Types Duplicator Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityLabinator Content Types Duplicator
- CVE-2025-31808WordPress SCSS WP Editor plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityIT Path Solutions SCSS WP Editor
- CVE-2025-31807WordPress Product Notices for WooCommerce plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) vulnerabilityCloudRedux Product Notices for WooCommerce
- CVE-2025-31806WordPress Webling plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerabilityuSystems Webling
- CVE-2025-31805WordPress Gutena Kit plugin <= 2.0.7 - Cross Site Scripting (XSS) vulnerabilitySaad Iqbal Gutena Kit – Gutenberg Blocks and Templates
- CVE-2025-31804WordPress Follow Us Badges plugin <= 3.1.11 - Cross Site Scripting (XSS) vulnerabilityDraftPress Team Follow Us Badges
- CVE-2025-31803WordPress Turisbook Booking System plugin <= 1.3.8 - Stored Cross Site Scripting (XSS) vulnerabilityNeteuro Turisbook Booking System
- CVE-2025-31802WordPress Shiptimize for WooCommerce plugin <= 3.1.86 - Settings Change vulnerabilityShiptimize for WooCommerce
- CVE-2025-31801WordPress MX Time Zone Clocks plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityMaksym Marko MX Time Zone Clocks
- CVE-2025-31799WordPress Publitio plugin <= 2.1.8 - Broken Access Control vulnerabilityPublitio
- CVE-2025-31798WordPress Publitio Plugin <= 2.1.8 - Broken Access Control vulnerabilityPublitio
- CVE-2025-31797WordPress Sprout Clients plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityBoldGrid Sprout Clients
- CVE-2025-31796WordPress ElementsCSS Addons for Elementor plugin <= 1.0.8.9 - Server Side Request Forgery (SSRF) vulnerabilityTheInnovs ElementsCSS Addons for Elementor
- CVE-2025-31793WordPress Piotnet Forms plugin <= 1.0.30 - Cross Site Scripting (XSS) vulnerabilitypiotnetdotcom Piotnet Forms
- CVE-2025-31792WordPress Piotnet Forms plugin <= 1.0.30 - Cross Site Scripting (XSS) vulnerabilitypiotnetdotcom Piotnet Forms
- CVE-2025-31791WordPress Pin Generator Plugin <= 2.0.0 - Broken Access Control vulnerabilityOliver Boyers Pin Generator
- CVE-2025-31790WordPress Posten plugin <= 0.0.1 - Cross Site Scripting (XSS) vulnerabilityBinsaifullah Posten
- CVE-2025-31788WordPress AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin <= 1.3 - Sensitive Data Exposure vulnerabilitySmackcoders Inc., AIO Performance Profiler, Monitor, Optimi…
- CVE-2025-31787WordPress Cue by AudioTheme.com plugin <= 2.4.4 - Broken Access Control vulnerabilityAudioTheme Cue
- CVE-2025-31786WordPress Simple Icons plugin <= 2.8.4 - Broken Access Control vulnerabilityTravis Simple Icons
- CVE-2025-31785WordPress Clearbit Reveal plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerabilityClearbit Reveal
- CVE-2025-31784WordPress Embed Extended – Embed Maps, Videos, Websites, Source Codes, and more Plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerabilityRudy Susanto Embed Extended
- CVE-2025-31783WordPress Leartes TRY Exchange Rates Plugin <= 2.1 - Stored Cross Site Scripting (XSS) vulnerabilityLeartes.NET Leartes TRY Exchange Rates
- CVE-2025-31782WordPress mb.YTPlayer plugin <= 3.3.8 - Broken Access Control vulnerabilitypupunzi mb.YTPlayer
- CVE-2025-31781WordPress Gift Cards for WooCommerce plugin <= 1.5.8 - Broken Access Control vulnerabilityahmadshyk Gift Cards for WooCommerce
- CVE-2025-31780WordPress Append Content plugin <= 2.1.1 - CSRF to Settings Change vulnerabilityAndy Stratton Append Content
- CVE-2025-31779WordPress Query Wrangler plugin <= 1.5.54 - Cross Site Request Forgery (CSRF) vulnerabilityJonathan Daggerhart Query Wrangler
- CVE-2025-31778WordPress Donate Me Plugin <= 1.2.5 - Stored Cross-Site Scripting vulnerabilityraphaelheide Donate Me
- CVE-2025-31777WordPress Clockinator Lite plugin <= 1.0.9 - Broken Access Control vulnerabilityBeastThemes Clockinator Lite
- CVE-2025-31776WordPress Uptime Robot Plugin <= 2.3 - Cross Site Request Forgery (CSRF) vulnerabilityAphotrax Uptime Robot Plugin for WordPress
- CVE-2025-31775WordPress Google SEO Pressor for Rich snippets Plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerabilitySmackcoders Inc., Google SEO Pressor Snippet
- CVE-2025-31774WordPress plugin Astra Security Suite plugin<= 0.2 - Broken Access Control vulnerabilityWebProtect.ai Astra Security Suite
- CVE-2025-31773WordPress Ship Per Product plugin <= 2.1.0 - Broken Access Control vulnerabilitycedcommerce Ship Per Product
- CVE-2025-31772WordPress WP Modal Popup with Cookie Integration plugin <= 2.4 - Cross Site Scripting (XSS) vulnerabilityAstoundify WP Modal Popup with Cookie Integration
- CVE-2025-31771WordPress Team Members for Elementor Page Builder plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerabilitySultan Nasir Uddin Team Members for Elementor Page Builder
- CVE-2025-31770WordPress Content Manager Light plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilityOTWthemes Content Manager Light
- CVE-2025-31769WordPress CLP – Custom Login Page by NiteoThemes plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerabilityCLP – Custom Login Page by NiteoThemes
- CVE-2025-31767WordPress Post Custom Templates Lite plugin <= 1.14 - Stored Cross Site Scripting (XSS) vulnerabilityOTWthemes Post Custom Templates Lite
- CVE-2025-31766WordPress PhotoShelter for Photographers Blog Feed plugin <= 1.5.7 - Cross Site Scripting (XSS) vulnerabilityPhotoShelter for Photographers Blog Feed Plugin
- CVE-2025-31765WordPress GDPR Cookie Notice plugin <= 1.2.0 - Broken Access Control vulnerabilitythemeqx GDPR Cookie Notice
- CVE-2025-31764WordPress Cache control by Cacholong plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerabilityPreliot Cache control by Cacholong
- CVE-2025-31763WordPress Cache control by Cacholong Plugin <= 5.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityPreliot Cache control by Cacholong
- CVE-2025-31762WordPress Sheet2Site plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerabilityandreyazimov Sheet2Site
- CVE-2025-31761WordPress Hypotext plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityDEJAN Hypotext
- CVE-2025-31760WordPress SnapWidget Social Photo Feed Widget plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerabilitySnapWidget Social Photo Feed Widget
- CVE-2025-31759WordPress Boo Recipes plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerabilityBooSpot Boo Recipes
- CVE-2025-31757WordPress Free Woocommerce Product Table View plugin <= 1.78 - Broken Access Control vulnerabilityBinaryCarpenter Free Woocommerce Product Table View
- CVE-2025-31756WordPress TZ PlusGallery Plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerabilitytuyennv TZ PlusGallery
- CVE-2025-31755WordPress pCloud Backup plugin <= 1.0.1 - Broken Access Control vulnerabilityjosselynj pCloud Backup
- CVE-2025-31754WordPress DobsonDev Shortcodes plugin <= 2.1.12 - Stored Cross Site Scripting (XSS) vulnerabilityDobsonDev Shortcodes
- CVE-2025-31752WordPress Bulk Fields Editor plugin <= 1.8.0 - Broken Access Control vulnerabilitytermel Bulk Fields Editor
- CVE-2025-31751WordPress Breaking News WP Plugin <= 1.3 - CSRF to Settings Change vulnerabilitydoit Breaking News WP
- CVE-2025-31750WordPress Breaking News WP Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitydoit Breaking News WP
- CVE-2025-31749WordPress HMH Footer Builder For Elementor plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilityWPelite HMH Footer Builder For Elementor
- CVE-2025-31748WordPress Opal Portfolio Plugin <= 1.0.4 - Stored Cross Site Scripting (XSS) vulnerabilitywpopal Opal Portfolio
- CVE-2025-31747WordPress WP Chrono plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilitymilan.latinovic WP Chrono
- CVE-2025-31745WordPress Subscription Form for Feedblitz Plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilityArni Cinco Subscription Form for Feedblitz
- CVE-2025-31744WordPress Lightweight and Responsive Youtube Embed plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilitywpszaki Lightweight and Responsive Youtube Embed
- CVE-2025-31743WordPress Lightweight and Responsive Youtube Embed Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerabilitywpszaki Lightweight and Responsive Youtube Embed
- CVE-2025-31742WordPress Dima Take Action Plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityPixelDima Dima Take Action
- CVE-2025-31741WordPress Easy Magazine plugin <= 2.1.13 - Cross Site Scripting (XSS) vulnerabilityFiltr8 Easy Magazine
- CVE-2025-31740WordPress News, Magazine and Blog Elements Plugin <= 1.3 - Stored Cross Site Scripting (XSS) vulnerabilityaThemeArt News, Magazine and Blog Elements
- CVE-2025-31738WordPress LeadQuizzes Plugin <= 1.1.0 - Stored Cross Site Scripting (XSS) vulnerabilityyazamodeveloper LeadQuizzes
- CVE-2025-31737WordPress Client Showcase plugin <= 1.2.0 - Stored Cross Site Scripting (XSS) vulnerabilitydxladner Client Showcase
- CVE-2025-31735WordPress Footnotes for WordPress plugin <= 2016.1230 - Cross Site Scripting (XSS) VulnerabilityC. Johnson Footnotes for WordPress
- CVE-2025-31734WordPress Simple Post Expiration plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilitySyed Balkhi Simple Post Expiration
- CVE-2025-31733WordPress WP Sitemap Plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityBoot Div WP Sitemap
- CVE-2025-31732WordPress GB Gallery Slideshow plugin <= 1.3 - Broken Access Control vulnerabilitygb-plugins GB Gallery Slideshow
- CVE-2025-31731WordPress Author Bio Shortcode Plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilityPhilip John Author Bio Shortcode
- CVE-2025-31730WordPress Marketer Addons Plugin <= 1.0.1 - Stored Cross Site Scripting (XSS) vulnerabilityDigitalCourt Marketer Addons
- CVE-2025-30676Apache OFBiz: Stored XSS VulnerabilityApache Software Foundation Apache OFBiz
- CVE-2025-30224MyDumper arbitrary file read issuemydumper
- CVE-2025-31408WordPress Zoho Flow plugin <= 2.13.3 - Broken Access Control vulnerabilityZoho Flow
- CVE-2025-3035Tab title disclosure across pages when using AI chatbotMozilla Firefox
- CVE-2025-3031JIT optimization bug with different stack slot sizesMozilla Firefox · Mozilla Thunderbird
- CVE-2025-3028Use-after-free triggered by XSLTProcessorMozilla Firefox · Mozilla Thunderbird
- CVE-2025-30177Apache Camel: Camel-Undertow Message Header Injection via Improper FilteringApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2025-3084MongoDB Server may crash due to improper validation of explain commandMongoDB Server
- CVE-2025-2906Contempo Real Estate Core <= 3.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecontempoinc Contempo Real Estate Core
- CVE-2025-3082User may override a view's collation and gain unauthorized access to underlying dataMongoDB Server
- CVE-2025-27130Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability.Welcart e-Commerce
- CVE-2025-29868Apache Answer: Using externally referenced images can leak user privacy.Apache Software Foundation Apache Answer · github.com/apach…
- CVE-2025-27427Apache ActiveMQ Artemis: Address routing-type can be updated by user without the createAddress permissionApache Software Foundation Apache ActiveMQ Artemis · org.ap…
- CVE-2025-1512PowerPack Elementor Addons (Free Widgets, Extensions and Templates) <= 2.9.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingideaboxcreations PowerPack Addons for Elementor
- CVE-2025-1267Groundhogg <= 3.7.4.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via label Parametertrainingbusinesspros Groundhogg — CRM, Newsletters, and Mar…
- CVE-2024-12189WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingposimyththemes WDesignKit – Elementor & Gutenberg Starter T…
- CVE-2025-2048Lana Downloads Manager < 1.10.0 - Admin+ Arbitrary File Download via Path TraversalLana Downloads Manager
- CVE-2025-1986Gutentor < 3.4.7 - Admin+ SQL InjectionGutentor
- CVE-2025-31409WordPress Bridge Core plugin < 3.3.1 - Cross Site Scripting (XSS) vulnerabilityNotFound Bridge Core
- CVE-2025-30926WordPress King Addons for Elementor plugin <= 24.12.58 - Broken Access Control VulnerabilityKingAddons.com King Addons for Elementor
- CVE-2025-30802WordPress Our Team Members plugin <= 2.2 - Sensitive Data Exposure vulnerabilityWPBean Our Team Members
- CVE-2025-30613WordPress Nmedia MailChimp plugin <= 5.4 - Cross Site Scripting (XSS) VulnerabilityN-Media Nmedia MailChimp
- CVE-2025-30594WordPress Include URL plugin <= 0.3.5 Arbitrary File Download Vulnerabilitysamsk Include URL
- CVE-2025-1665Avada Builder <= 3.11.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemefusion Avada (Fusion) Builder
- CVE-2025-0418Valmet DNA user passwords in plain textValmet DNA
- CVE-2025-1534Cross-site Scripting (Stored)Payara Platform Payara Server
- CVE-2025-3051Linux::Statm::Tiny for Perl allows untrusted code to be included from the current working directoryRRWO Linux::Statm::Tiny
- CVE-2025-30673Sub::HandlesVia for Perl allows untrusted code to be included from the current working directoryTOBYINK Sub::HandlesVia
- CVE-2025-30672Mite for Perl generates code with an untrusted search path vulnerabilityTOBYINK Mite
- CVE-2025-3045oretnom23/SourceCodester Apartment Visitor Management System remove-apartment.php sql injectionoretnom23 Apartment Visitor Management System · SourceCodes…
- CVE-2025-3043GuoMinJim PersonManage login preHandle path traversalGuoMinJim PersonManage
- CVE-2025-3042Project Worlds Online Time Table Generator updateprofile.php unrestricted uploadProject Worlds Online Time Table Generator
- CVE-2003-20001An issue was discovered on Mitel ICP VoIP 3100 devices.
- CVE-2023-46988Path Traversal vulnerability in ONLYOFFICE Document Server before v8.0.1 allows a remote attacker to copy arbitrary files by manipulating th
- CVE-2025-26054Infinxt iEdge 100 2.1.32 is vulnerable to Cross Site Scripting (XSS) via the "Description" field during LAN configuration.
- CVE-2025-26055An OS Command Injection vulnerability exists in the Infinxt iEdge 100 2.1.32 Troubleshoot module, specifically in the tracertVal parameter o
- CVE-2025-26056A command injection vulnerability exists in the Infinxt iEdge 100 2.1.32 in the Troubleshoot module "MTR" functionality.
- CVE-2025-28131A Broken Access Control vulnerability in Nagios Network Analyzer 2024R1.0.3 allows low-privilege users with "Read-Only" access to perform ad
- CVE-2025-28132A session management flaw in Nagios Network Analyzer 2024R1.0.3 allows an attacker to reuse session tokens even after a user logs out, leadi
- CVE-2025-29036An issue in hackathon-starter v.8.1.0 allows a remote attacker to escalate privileges via the user.js component.
- CVE-2025-29049Cross Site Scripting vulnerability in arnog MathLive Versions v0.103.0 and before (fixed in 0.104.0) allows an attacker to execute arbitrarymathlive
- CVE-2025-29208CodeZips Gym Management System v1.0 is vulnerable to SQL injection in the name parameter within /dashboard/admin/deleteroutine.php.