CVEs published May 7, 2025
305 CVEs were published on May 7, 2025: 11 critical, 83 high. 3 are now in CISA KEV.
- Published
- 305
- Critical
- 11
- High
- 83
- Medium
- 205
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 38
Most affected products
- Cisco IOS XE Software
- 19
- Samsung Mobile Devices
- 13
- RT-Labs P-Net
- 10
- F5 BIG-IP
- 9
- Cisco Catalyst SD-WAN Manager
- 6
- BOINC Server
- 4
- Cisco IOS
- 4
- Samsung Mobile Samsung Gallery
- 4
- F5OS - Appliance · F5OS - Chassis
- 3
- PeproDev Ultimate Profile Solutions
- 3
Critical 11
- CVE-2025-3476Incorrect Authorization vulnerability in OpenText™ Operations Bridge Manager.OpenText™ Operations Bridge Manager
- CVE-2025-46828Unauthenticated SQL Injection on get_socios.php endpointLabRedesCefetRJ WeGIA
- CVE-2025-20188A vulnerability in the Out-of-Band Access Point (AP) Image Download, the Clean Air Spectral Recording, and the client debug bundles featuresCisco IOS XE Software
- CVE-2025-2777SysAid On-Prem <= 23.3.40 lshw Proceessing XML External Entity InjectionSysAid On-Prem
- CVE-2025-2776SysAid On-Prem <= 23.3.40 serverurl Proceessing XML External Entity InjectionSysAid On-Prem
- CVE-2025-2775SysAid On-Prem <= 23.3.40 Checkin Proceessing XML External Entity InjectionSysAid On-Prem
- CVE-2025-47657WordPress Productive Commerce plugin <= 1.1.40 - SQL Injection vulnerabilityProductive Minds Productive Commerce
- CVE-2025-47549WordPress BEAF plugin <= 4.6.10 - Arbitrary File Upload VulnerabilityThemefic BEAF
- CVE-2025-4104Frontend Dashboard 1.0 - 2.2.6 - Missing Authorization to Unauthenticated Privilege Escalation via fed_wp_ajax_fed_login_form_post Functionvinoth06 Frontend Dashboard
- CVE-2025-0668BOINC Server Multiple SQL InjectionsBOINC Server
- CVE-2025-3844PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account TakeoverPeproDev Ultimate Profile Solutions
High 83
- CVE-2025-46727Unbounded-Parameter DoS in Rack::QueryParserrack
- CVE-2025-41431TMM VulnerabilityF5 BIG-IP
- CVE-2025-31644Appliance mode BIG-IP iControl REST and tmsh vulnerabilityF5 BIG-IP
- CVE-2025-35995BIG-IP PEM vulnerabilityF5 BIG-IP
- CVE-2025-36525BIG-IP APM PingAccess Virtual Server VulnerabilityF5 BIG-IP
- CVE-2025-36504BIG-IP HTTP/2 vulnerabilityF5 BIG-IP
- CVE-2025-41414BIG-IP HTTP/2 vulnerabilityF5 BIG-IP
- CVE-2025-41433BIG-IP SIP ALG profile vulnerabilityF5 BIG-IP
- CVE-2025-46265F5OS vulnerabilityF5OS - Appliance · F5OS - Chassis
- CVE-2025-36546F5OS Appliance Mode vulnerabilityF5OS - Appliance · F5OS - Chassis
- CVE-2025-36557BIG-IP HTTP vulnerabilityF5 BIG-IP
- CVE-2025-41399SCTP VulnerabilityF5 BIG-IP
- CVE-2025-3925BrightSign Players Execution with Unnecessary PrivilegesBrightSign OS series 4 players · BrightSign OS series 5 pla…
- CVE-2025-30147ALTBN128_ADD, ALTBN128_MUL, ALTBN128_PAIRING precompile functions do not check if points are on curvehyperledger besu-native
- CVE-2025-20162A vulnerability in the DHCP snooping security feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a fuCisco IOS XE Software
- CVE-2025-20186A vulnerability in the web-based management interface of the Wireless LAN Controller feature of Cisco IOS XE Software could allow an authentCisco IOS XE Software
- CVE-2025-20140A vulnerability in the Wireless Network Control daemon (wncd) of Cisco IOS XE Software for Wireless LAN Controllers (WLCs) could allow an unCisco IOS XE Software
- CVE-2025-20164A vulnerability in the Cisco Industrial Ethernet Switch Device Manager (DM) of Cisco IOS Software could allow an authenticated, remote attacCisco IOS
- CVE-2025-20192A vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation of Cisco IOS XE Software could allow an authenticated, remote Cisco IOS XE Software
- CVE-2025-20189A vulnerability in the Cisco Express Forwarding functionality of Cisco IOS XE Software for Cisco ASR 903 Aggregation Services Routers with RCisco IOS XE Software
- CVE-2025-20202A vulnerability in Cisco IOS XE Wireless Controller Software could allow an unauthenticated, adjacent attacker to cause a denial of service Cisco IOS XE Software
- CVE-2025-32821A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN admin privileges can with admin privileges can inject shell comSonicWall SMA100
- CVE-2025-32820A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges can inject a path traversal sequence to make anSonicWall SMA100
- CVE-2025-20154Cisco IOS, IOS XE and IOS XR Software TWAMP Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2025-20191Multiple Cisco Products Denial of Service VulnerabilityCisco NX-OS Software · Cisco Wireless LAN Controller
- CVE-2025-20122Cisco Catalyst SD-WAN Manager Privilege Escalation VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-32819A vulnerability in SMA100 allows a remote authenticated attacker with SSLVPN user privileges to bypass the path traversal checks and delete SonicWall SMA100
- CVE-2025-20182Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software and IOS XE Software IKEv2 Denial of Service VulnerabilityCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2025-20210Cisco Catalyst Center Unprotected API EndpointCisco Digital Network Architecture Center
- CVE-2025-46827Graylog Allows Session Takeover via Insufficient HTML Sanitizationgraylog2-server · org.graylog2:graylog2-server
- CVE-2024-47619tranport: TLS host name wildcard matching too laxsyslog-ng
- CVE-2025-47685WordPress Contribuinte Checkout plugin <= 2.0.03 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityMoloni Contribuinte Checkout
- CVE-2025-47683WordPress WP Maintenance plugin <= 6.1.9.7 - PHP Object Injection VulnerabilityFlorent Maillefaud WP Maintenance
- CVE-2025-47655WordPress theMarketer plugin <= 1.4.7 - CSRF to Stored XSS vulnerabilitythemarketer2023 theMarketer
- CVE-2025-47653WordPress WP-Recall <= 16.26.14 - Local File Inclusion Vulnerabilitytggfref WP-Recall
- CVE-2025-47649WordPress Open Close WooCommerce Store plugin <= 4.9.9 - Local File Inclusion vulnerabilityStackWC Open Close WooCommerce Store
- CVE-2025-47648WordPress Pays – WooCommerce Payment Gateway plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerabilityaxima Pays – WooCommerce Payment Gateway
- CVE-2025-47643WordPress ELEX Product Feed for WooCommerce <= 3.1.2 - SQL Injection VulnerabilityELEXtensions ELEX Product Feed for WooCommerce
- CVE-2025-47639WordPress Supertext Translation and Proofreading plugin <= 4.26 - CSRF to Stored XSS vulnerabilitySupertext Translation and Proofreading
- CVE-2025-47636WordPress List category posts plugin <= 0.91.0 - Local File Inclusion VulnerabilityFernando Briano List category posts
- CVE-2025-47629WordPress WP-CRM System plugin <= 3.4.5 - PHP Object Injection vulnerabilityMario Peshev WP-CRM System
- CVE-2025-47620WordPress Martins Free Monetized Ad Exchange Network plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerabilitybundgaard Martins Free Monetized Ad Exchange Network
- CVE-2025-47587WordPress YaySMTP plugin <= 2.6.4 - SQL Injection VulnerabilityYayCommerce YaySMTP
- CVE-2025-47546WordPress WP Compress plugin <= 6.30.30 - Cross Site Request Forgery (CSRF) VulnerabilityAresIT WP Compress
- CVE-2025-47544WordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.8 - SQL Injection Vulnerabilityacowebs Dynamic Pricing With Discount Rules for WooCommerce
- CVE-2025-47538WordPress Cart tracking for WooCommerce plugin <= 1.0.17 - SQL Injection Vulnerabilitywpdever Cart tracking for WooCommerce
- CVE-2025-47537WordPress PDF Invoice Builder for WooCommerce plugin <= 5.3.8 - SQL Injection Vulnerabilityadd-ons.org PDF Invoice Builder for WooCommerce
- CVE-2025-47533WordPress Graphina plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) to Local File Inclusion vulnerabilityIqonic Design Graphina
- CVE-2025-47531WordPress XT Event Widget for Social Events plugin <= 1.1.7 - Local File Inclusion VulnerabilityXylus Themes XT Event Widget for Social Events
- CVE-2025-47517WordPress Accept Donations with PayPal plugin <= 1.4.5 - CSRF to Stored XSS vulnerabilityScott Paterson Accept Donations with PayPal & Stripe
- CVE-2025-47514WordPress ELI's Related Posts Footer Links and Widget plugin <= 1.2.04.20 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityELI's Related Posts Footer Links and Widget
- CVE-2025-47510WordPress Display Eventbrite Events plugin < 6.3 - Local File Inclusion Vulnerabilityfullworks Display Eventbrite Events
- CVE-2025-47508WordPress GamiPress plugin <= 7.3.7 - Local File Inclusion VulnerabilityRuben Garcia GamiPress
- CVE-2025-47498WordPress Hotel Booking plugin <= 3.6 - Local File Inclusion Vulnerabilitynicdark Hotel Booking
- CVE-2025-47496WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion VulnerabilityPublishPress Authors
- CVE-2025-47494WordPress EventON plugin <= 2.4.1 - Local File Inclusion VulnerabilityAshan Perera EventON
- CVE-2025-47491WordPress Contact Form Widget plugin <= 1.4.6 - Cross Site Request Forgery (CSRF) VulnerabilityA WP Life Contact Form Widget
- CVE-2025-47490WordPress Ultimate WP Mail plugin <= 1.3.4 - SQL Injection VulnerabilityRustaurius Ultimate WP Mail
- CVE-2025-47462WordPress Challan plugin <= 3.7.58 - CSRF to Privilege Escalation vulnerabilityWebAppick Challan
- CVE-2025-47460WordPress TrackShip for WooCommerce plugin <= 1.9.1 - SQL Injection VulnerabilityTrackShip for WooCommerce
- CVE-2025-47440WordPress WPAdverts plugin <= 2.2.2 - Local File Inclusion VulnerabilityGreg Winiarski WPAdverts
- CVE-2025-47439WordPress Download Monitor plugin <= 5.0.22 - Local File Inclusion VulnerabilityWP Chill Download Monitor
- CVE-2020-36791net_sched: keep alloc_hash updated after hash allocationLinux
- CVE-2025-33093IBM Sterling Partner Engagement Manager information disclosureIBM Sterling Partner Engagement Manager
- CVE-2025-20979Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code.Samsung Mobile libsavscmn
- CVE-2025-20968Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Samsung Mobile Samsung Gallery
- CVE-2025-20957Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch arbitrary activities with SmartMaSamsung Mobile Devices
- CVE-2025-0669BOINC Server Cross-Site Request ForgeryBOINC Server
- CVE-2025-0667BOINC Server Stored XSS Injection in pm.phpBOINC Server
- CVE-2025-0666BOINC Server Stored XSS Injection in host_venue_action.phpBOINC Server
- CVE-2025-32405An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by RT-Labs P-Net
- CVE-2025-32402An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the library by RT-Labs P-Net
- CVE-2025-32400An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the librRT-Labs P-Net
- CVE-2025-32398A NULL Pointer Dereference in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the libraryRT-Labs P-Net
- CVE-2025-32397An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the librRT-Labs P-Net
- CVE-2025-32396An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to induce a crash in IO devices that use the librRT-Labs P-Net
- CVE-2025-3921PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Limited Unauthenticated Arbitrary User Meta Update via handel_ajax_req FunctionPeproDev Ultimate Profile Solutions
- CVE-2025-3852WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Authenticated (Subscriber+) Privilege Escalation via Account Takeovereoxia WPshop 2 – E-Commerce
- CVE-2025-4335Woocommerce Multiple Addresses <= 1.0.7.1 - Authenticated (Subscriber+) Privilege Escalationn3wnormal Woocommerce Multiple Addresses
- CVE-2025-26168IXON VPN Client before 1.4.4 on Linux and macOS allows Local Privilege Escalation to root because there is code execution from a configuratiIXON VPN Client
- CVE-2025-26169IXON VPN Client before 1.4.4 on Windows allows Local Privilege Escalation to SYSTEM because there is code execution from a configuration filIXON VPN Client
- CVE-2025-29152Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple comp
- CVE-2025-29448Booking logic flaw in Easy!Appointments v1.5.1 allows unauthenticated attackers to create appointments with excessively long durations, causalextselegidis/easyappointments
Medium, low and unrated 211
- CVE-2024-55651i-Educar Stored Cross-Site Scripting vulnerabilityportabilis i-educar
- CVE-2025-32441Rack session gets restored after deletionrack
- CVE-2025-0936On affected platforms running Arista EOS with a gNMI transport enabled, running the gNOI File TransferToRemote RPC with credentials for a remote server may cause these remote-server credentials to be logged or accounted on the local EOS device or possiblyArista Networks EOS
- CVE-2025-35939Craft CMS stores user-provided content in session filesCraft CMS · craftcms/cms
- CVE-2025-43878F5OS-A/C CLI vulnerabilityF5OS - Appliance · F5OS - Chassis
- CVE-2023-7303q2apro q2apro-on-site-notifications q2apro-onsitenotifications-page.php process_request cross site scriptingq2apro-on-site-notifications
- CVE-2025-46826insa-auth Open-Redirect on provided CAS server login endpointINSAgenda insa-auth
- CVE-2025-46821Envoy vulnerable to bypass of RBAC uri_template permissionenvoyproxy envoy
- CVE-2025-31177Gnuplot: gnuplot heap-buffer overflow on utf8_copy_onegnuplot · Red Hat Enterprise Linux
- CVE-2025-4043Milesight UG65-868M-EA Improper Access Control for Volatile Memory Containing Boot CodeMilesight UG65-868M-EA
- CVE-2025-3272Incorrect user authorization vulnerability has been identified in Open Text Operations Bridge Manager.OpenText™ Operations Bridge Manager
- CVE-2025-20195A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an unauthenticated, remote attacker to perform a Cisco IOS XE Software
- CVE-2025-20194A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attackerCisco IOS XE Software
- CVE-2025-20193A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, low-privileged, remote attackerCisco IOS XE Software
- CVE-2025-20201A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegCisco IOS XE Software
- CVE-2025-20200A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegCisco IOS XE Software
- CVE-2025-20199A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegCisco IOS XE Software
- CVE-2025-20198A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegCisco IOS XE Software
- CVE-2025-20197A vulnerability in the CLI of Cisco IOS XE Software could allow an authenticated, local attacker with privilege level 15 to elevate privilegCisco IOS XE Software
- CVE-2025-20221A vulnerability in the packet filtering features of Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to bypass LCisco IOS XE Software
- CVE-2025-20196A vulnerability in the Cisco IOx application hosting environment of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticaCisco IOS
- CVE-2025-46824Discourse Code Review Plugin vulnerable to XSS via auto link commitsdiscourse-code-review
- CVE-2025-20223A vulnerability in Cisco Catalyst Center, formerly Cisco DNA Center, could allow an authenticated, remote attacker to read and modify data iCisco Digital Network Architecture Center
- CVE-2025-20155A vulnerability in the bootstrap loading of Cisco IOS XE Software could allow an authenticated, local attacker to write arbitrary files to aCisco IOS XE Software
- CVE-2025-20181A vulnerability in Cisco IOS Software for Cisco Catalyst 2960X, 2960XR, 2960CX, and 3560CX Series Switches could allow an authenticated, locCisco IOS
- CVE-2025-20190A vulnerability in the lobby ambassador web interface of Cisco IOS XE Wireless Controller Software could allow an authenticated, remote attaCisco IOS XE Software
- CVE-2025-20214A vulnerability in the Network Configuration Access Control Module (NACM) of Cisco IOS XE Software could allow an authenticated, remote attaCisco IOS XE Software
- CVE-2025-20137A vulnerability in the access control list (ACL) programming of Cisco IOS Software that is running on Cisco Catalyst 1000 Switches and CiscoCisco IOS
- CVE-2025-20147Cisco SD-WAN vManage Stored Cross-Site Scripting VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-20216Cisco Catalyst SD-WAN Manager Reflected HTML Injection VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-20151Cisco IOS and IOS XE Software SNMPv3 Configuration Restriction VulnerabilityCisco IOS XE Catalyst SD-WAN
- CVE-2025-20187Cisco SD-WAN Manager Software Arbitrary File Creation VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-20213Cisco Catalyst SDWAN Manager Arbitrary File Overwrite VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-20157Cisco Catalyst vManage Certificate Validation VulnerabilityCisco Catalyst SD-WAN Manager
- CVE-2025-46551JRuby-OpenSSL has hostname verification disabled by defaultjruby-openssl · rubygems:jruby-openssl +1
- CVE-2025-47692WordPress ContentStudio plugin <= 1.3.5 - Broken Access Control VulnerabilityContentstudio
- CVE-2025-47691WordPress Ultimate Member plugin <= 2.10.3 - Arbitrary Function Call vulnerabilityUltimate Member
- CVE-2025-47688WordPress Advanced File Manager plugin <= 5.3.1 - Broken Access Control to Notice Dismissal vulnerabilitySaad Iqbal Advanced File Manager
- CVE-2025-47686WordPress DELUCKS SEO plugin <= 2.5.9 - Cross Site Scripting (XSS) VulnerabilityDELUCKS SEO
- CVE-2025-47684WordPress Smaily for WP plugin <= 3.1.7 - Cross Site Request Forgery (CSRF) VulnerabilitySmaily for WP
- CVE-2025-47681WordPress Web Accessibility with Max Access plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) VulnerabilityAbility Web Accessibility with Max Access
- CVE-2025-47679WordPress RS WP Book Showcase plugin <= 6.7.59 - Cross Site Scripting (XSS) vulnerabilityRS WP THEMES RS WP Book Showcase
- CVE-2025-47677WordPress Photo Gallery - GT3 Image Gallery & Gutenberg Block Gallery plugin <= 2.7.7.25 - Cross Site Scripting (XSS) Vulnerabilitygt3themes Photo Gallery
- CVE-2025-47676WordPress User Login History plugin <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilityFaiyaz Alam User Login History
- CVE-2025-47675WordPress Woobox plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityWoobox
- CVE-2025-47674WordPress Credova_Financial plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) VulnerabilityCredova Financial Credova_Financial
- CVE-2025-47669WordPress CBX Map for Google Map & OpenStreetMap plugin <= 1.1.12 - Cross Site Scripting (XSS) VulnerabilitySabuj Kundu CBX Map for Google Map & OpenStreetMap
- CVE-2025-47668WordPress CookieCode plugin <= 2.4.4 - Cross Site Scripting (XSS) VulnerabilityCookieCode
- CVE-2025-47667WordPress LiveAgent plugin <= 4.4.7 - Cross Site Request Forgery (CSRF) Vulnerabilityqusupport LiveAgent
- CVE-2025-47665WordPress N360 | Splash Screen plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerabilitybistromatic N360 | Splash Screen
- CVE-2025-47664WordPress WP Pipes <= 1.4.2 - Server Side Request Forgery (SSRF) VulnerabilityThimPress WP Pipes
- CVE-2025-47662WordPress Woobox plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityWoobox
- CVE-2025-47661WordPress 워드프레스 결제 심플페이 plugin <= 5.2.11 - Cross Site Request Forgery (CSRF) Vulnerabilitycodemstory 워드프레스 결제 심플페이
- CVE-2025-47659WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerabilityvoidcoders WPBakery Visual Composer WHMCS Elements
- CVE-2025-47656WordPress Spiraclethemes Site Library plugin <= 1.5.4 - Cross Site Scripting (XSS) VulnerabilitySpiracle Themes Spiraclethemes Site Library
- CVE-2025-47647WordPress Sidebar Manager Light plugin <= 1.18 - Cross Site Request Forgery (CSRF) VulnerabilityOTWthemes Sidebar Manager Light
- CVE-2025-47644WordPress Integrations of Zoho CRM with Elementor form plugin <= 1.0.8 - Open Redirection Vulnerabilityformsintegrations Integrations of Zoho CRM with Elementor f…
- CVE-2025-47638WordPress WP Discord Invite plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerabilitySarvesh M Rao WP Discord Invite
- CVE-2025-47635WordPress WebinarPress plugin <= 1.33.28 - Server Side Request Forgery (SSRF) VulnerabilityWPWebinarSystem WebinarPress
- CVE-2025-47633WordPress Awin – Advertiser Tracking for WooCommerce plugin <= 2.0.0 - CSRF to Product Feed Regeneration vulnerabilityAwin – Advertiser Tracking for WooCommerce
- CVE-2025-47632WordPress Awesome Gallery plugin <= 1.0 - Cross Site Scripting (XSS) VulnerabilityRaihanul Islam Awesome Gallery
- CVE-2025-47630WordPress Ajax Load More plugin <= 7.3.1.2 - Cross Site Scripting (XSS) VulnerabilityDarren Cooney Ajax Load More
- CVE-2025-47628WordPress QS Dark Mode plugin <= 3.0 - Broken Access Control Vulnerabilityquomodosoft QS Dark Mode
- CVE-2025-47626WordPress Submission DOM tracking for Contact Form 7 plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityapasionados Submission DOM tracking for Contact Form
- CVE-2025-47625WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerabilityapasionados DoFollow Case by Case
- CVE-2025-47624WordPress DoFollow Case by Case plugin <= 3.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityapasionados DoFollow Case by Case
- CVE-2025-47623WordPress Easy PayPal Buy Now Button plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityScott Paterson Easy PayPal Buy Now Button
- CVE-2025-47622WordPress Email Notification on Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerabilityapasionados Email Notification on Login
- CVE-2025-47621WordPress Meks Flexible Shortcodes plugin <= 1.3.6 - Cross Site Scripting (XSS) VulnerabilityMeks Flexible Shortcodes
- CVE-2025-47617WordPress WP Front User Submit / Front Editor plugin <= 5.0.6 - Cross Site Scripting (XSS) vulnerabilityaharonyan WP Front User Submit / Front Editor
- CVE-2025-47616WordPress aBlocks plugin <= 1.9.2 - Cross Site Scripting (XSS) VulnerabilityKodezen aBlocks
- CVE-2025-47615WordPress Amazon Product in a Post plugin <= 5.2.2 - Cross Site Scripting (XSS) Vulnerabilityflowdee Amazon Product in a Post
- CVE-2025-47614WordPress LessButtons Social Sharing and Statistics plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityChris Clark LessButtons Social Sharing and Statistics
- CVE-2025-47612WordPress ClickWhale plugin <= 2.4.6 - Broken Access Control VulnerabilityClickWhale
- CVE-2025-47609WordPress EasyMe Connect plugin <= 3.0.3 - Cross Site Request Forgery (CSRF) vulnerabilityeasymebiz EasyMe Connect
- CVE-2025-47607WordPress Show All Comments plugin <= 7.0.1 - Cross Site Scripting (XSS) VulnerabilityAppJetty Show All Comments
- CVE-2025-47606WordPress Simple Giveaways plugin <= 2.49.0 - Cross Site Request Forgery (CSRF) vulnerabilityIgor Benic Simple Giveaways
- CVE-2025-47605WordPress WP jQuery DataTable plugin <= 4.1.0 - Cross Site Scripting (XSS) VulnerabilityAppJetty WP jQuery DataTable
- CVE-2025-47604WordPress Inline Related Posts plugin <= 3.8.0 - Cross Site Scripting (XSS) VulnerabilityData443 Risk Mitigation Inline Related Posts
- CVE-2025-47602WordPress Calculate Prices based on Distance For WooCommerce plugin <= 1.3.5 - Broken Access Control vulnerabilityammarahmad786 Calculate Prices based on Distance For WooCom…
- CVE-2025-47597WordPress WP Podcasts Manager plugin <= 1.3 - Cross Site Request Forgery (CSRF) vulnerabilityMaulik Vora WP Podcasts Manager
- CVE-2025-47596WordPress Beacon Lead Magnets and Lead Capture plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerabilitySyed Balkhi Beacon Lead Magnets and Lead Capture
- CVE-2025-47595WordPress Color Your Bar plugin <= 2.0 - Cross Site Scripting (XSS) VulnerabilityDarshan Saroya Color Your Bar
- CVE-2025-47594WordPress Soccer Live Scores <= 1.0.5 - Cross Site Request Forgery (CSRF) VulnerabilityDAEXT Soccer Live Scores
- CVE-2025-47593WordPress Really Simple Under Construction Page plugin <= 1.4.6 - Cross Site Scripting (XSS) VulnerabilityJonas Hjalmarsson Really Simple Under Construction Page
- CVE-2025-47592WordPress Legal Terms and Conditions Popup for User Login and WooCommerce Checkout – TPUL plugin <= 2.0.8 - Cross Site Scripting (XSS) VulnerabilityÁrpád Lehel Mátyus Terms Popup On User Login
- CVE-2025-47591WordPress Bulk Featured Image plugin <= 1.2.4 - Broken Access Control vulnerabilityCreedAlly Bulk Featured Image
- CVE-2025-47590WordPress WPSpeed plugin <= 2.6.5 - Cross Site Request Forgery (CSRF) VulnerabilityJExtensions Store WPSpeed
- CVE-2025-47589WordPress Ebook Store plugin <= 5.8009 - Cross Site Scripting (XSS) Vulnerabilitymotov.net Ebook Store
- CVE-2025-47551WordPress Wiki Embed plugin <= 1.4.6 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityctltwp Wiki Embed
- CVE-2025-47550WordPress Instantio plugin <= 3.3.16 - Arbitrary File Upload VulnerabilityThemefic Instantio
- CVE-2025-47548WordPress Wbcom Designs - Activity Link Preview For BuddyPress plugin <= 1.4.4 - Server Side Request Forgery (SSRF) VulnerabilityVarun Dubey Wbcom Designs - Activity Link Preview For Buddy…
- CVE-2025-47547WordPress SendPulse Email Marketing Newsletter plugin <= 2.1.6 - Cross Site Scripting (XSS) VulnerabilitySendPulse Email Marketing Newsletter
- CVE-2025-47545WordPress Poll Maker plugin <= 5.7.7 - Race Condition VulnerabilityAys Pro Poll Maker
- CVE-2025-47543WordPress TrueBooker plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) Vulnerabilitythemetechmount TrueBooker
- CVE-2025-47542WordPress Simple calendar for Elementor plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) VulnerabilityMichael Simple calendar for Elementor
- CVE-2025-47540WordPress weMail plugin <= 1.14.13 - Sensitive Data Exposure VulnerabilityweDevs weMail
- CVE-2025-47528WordPress Ovation Elements plugin <= 1.1.2 - Broken Access Control Vulnerabilitypewilliams Ovation Elements
- CVE-2025-47526WordPress GS Variation Swatches for WooCommerce plugin <= 3.0.4 - Broken Access Control VulnerabilityGS Plugins GS Variation Swatches for WooCommerce
- CVE-2025-47525WordPress Bold Page Builder plugin <= 5.3.0 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
- CVE-2025-47524WordPress Quran multilanguage Text & Audio plugin <= 2.3.23 - Cross Site Scripting (XSS) Vulnerabilitykarim42 Quran multilanguage Text & Audio
- CVE-2025-47523WordPress Seznam Webmaster plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) VulnerabilityLukáš Hartmann Seznam Webmaster
- CVE-2025-47522WordPress AWEOS WP Lock plugin <= 1.4.8 - Cross Site Scripting (XSS) VulnerabilityAWEOS WP Lock
- CVE-2025-47521WordPress Robo Gallery plugin <= 5.0.2 - Cross Site Scripting (XSS) Vulnerabilityrobosoft Robo Gallery
- CVE-2025-47520WordPress Charitable plugin <= 1.8.5.1 - Cross Site Scripting (XSS) VulnerabilitySyed Balkhi Charitable
- CVE-2025-47519WordPress Easy PayPal Events plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) VulnerabilityScott Paterson Easy PayPal Events
- CVE-2025-47518WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.3.4 - Cross Site Scripting (XSS) VulnerabilityScott Paterson Contact Form 7 – PayPal & Stripe Add-on
- CVE-2025-47516WordPress Time Clock plugin <= 1.2.3 - Cross Site Scripting (XSS) VulnerabilityScott Paterson Time Clock
- CVE-2025-47515WordPress WP DPE-GES plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilitySeb WP DPE-GES
- CVE-2025-47509WordPress Top 10 plugin <= 4.1.0 - Cross Site Scripting (XSS) VulnerabilityAjay Top
- CVE-2025-47507WordPress Better Search plugin <= 4.1.0 - Cross Site Scripting (XSS) VulnerabilityAjay Better Search
- CVE-2025-47506WordPress Contextual Related Posts plugin <= 4.0.2 - Cross Site Scripting (XSS) VulnerabilityAjay Contextual Related Posts
- CVE-2025-47505WordPress Product Time Countdown for WooCommerce plugin <= 1.6.2 - Cross Site Scripting (XSS) VulnerabilityProWCPlugins Product Time Countdown for WooCommerce
- CVE-2025-47504WordPress Custom Checkout Fields for WooCommerce plugin <= 1.8.3 - Cross Site Scripting (XSS) VulnerabilityWPFactory Custom Checkout Fields for WooCommerce
- CVE-2025-47503WordPress NGG Smart Image Search plugin <= 3.3.3 - Cross Site Scripting (XSS) Vulnerabilitywpo-HR NGG Smart Image Search
- CVE-2025-47502WordPress Mollie Forms plugin <= 2.7.12 - Cross Site Scripting (XSS) VulnerabilityNick van Wobbie Mollie Forms
- CVE-2025-47501WordPress Content Control plugin <= 2.6.1 - Cross Site Scripting (XSS) VulnerabilityDaniel Iser Content Control
- CVE-2025-47499WordPress Simple Blog Stats plugin <= 20250416 - Cross Site Scripting (XSS) VulnerabilityJeff Starr Simple Blog Stats
- CVE-2025-47497WordPress Logo Showcase plugin <= 3.0.4 - Cross Site Scripting (XSS) VulnerabilityThemepoints Logo Showcase
- CVE-2025-47495WordPress Blockspare plugin <= 3.2.9 - Cross Site Scripting (XSS) VulnerabilityBlockspare
- CVE-2025-47493WordPress Ultimate Blocks plugin <= 3.2.9 - Cross Site Scripting (XSS) VulnerabilityUltimate Blocks
- CVE-2025-47489WordPress Beds24 Online Booking plugin <= 2.0.29 - Cross Site Scripting (XSS) Vulnerabilitymarkkinchin Beds24 Online Booking
- CVE-2025-47488WordPress Bold Page Builder plugin <= 5.3.2 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
- CVE-2025-47486WordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 3.1.9 - Broken Access Control VulnerabilityCyberChimps Responsive Plus
- CVE-2025-47485WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control VulnerabilityCozyThemes Cozy Blocks
- CVE-2025-47484WordPress Display Remote Posts Block plugin <= 1.1.0 - Server Side Request Forgery (SSRF) VulnerabilityOliver Campion Display Remote Posts Block
- CVE-2025-47483WordPress Easy Replace Image plugin <= 3.5.0 - Server Side Request Forgery (SSRF) VulnerabilityIulia Cazan Easy Replace Image
- CVE-2025-47482WordPress SKT Skill Bar plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerabilitysonalsinha21 SKT Skill Bar
- CVE-2025-47481WordPress GS Testimonial Slider plugin <= 3.2.9 - Content Injection vulnerabilityGS Plugins GS Testimonial Slider
- CVE-2025-47480WordPress Graphina plugin <= 3.0.4 - Broken Access Control VulnerabilityIqonic Design Graphina
- CVE-2025-47476WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerabilityadd-ons.org Cost Calculator for Elementor
- CVE-2025-47475WordPress JupiterX Core plugin <= 4.8.11 - Cross Site Scripting (XSS) Vulnerabilityartbees JupiterX Core
- CVE-2025-47473WordPress PW WooCommerce Bulk Edit plugin <= 2.134 - Cross Site Request Forgery (CSRF) Vulnerabilitypimwick PW WooCommerce Bulk Edit
- CVE-2025-47472WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerabilitycodepeople Music Player for WooCommerce
- CVE-2025-47471WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control VulnerabilityEnvoThemes Envo Extra
- CVE-2025-47470WordPress GPT3 AI Content Writer plugin <= 1.9.14 - Cross Site Request Forgery (CSRF) to Prompt Generation vulnerabilitysenols GPT3 AI Content Writer
- CVE-2025-47469WordPress Media Hygiene plugin <= 4.0.0 - Broken Access Control Vulnerabilityslui Media Hygiene
- CVE-2025-47468WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerabilityhashthemes Hash Form
- CVE-2025-47467WordPress GS Testimonial Slider plugin <= 3.3.0 - Broken Access Control VulnerabilityGS Plugins GS Testimonial Slider
- CVE-2025-47466WordPress Ultimate WP Mail plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) VulnerabilityRustaurius Ultimate WP Mail
- CVE-2025-47465WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerabilitycreativethemeshq Blocksy
- CVE-2025-47464WordPress Solace Extra plugin <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerabilitysolacewp Solace Extra
- CVE-2025-47459WordPress WP Fundraising Donation and Crowdfunding Platform plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) VulnerabilityRoxnor FundEngine
- CVE-2025-47457WordPress LocateAndFilter plugin <= 1.6.16 - Broken Access Control Vulnerabilitydgamoni LocateAndFilter
- CVE-2025-47456WordPress WP Gravity Forms Zendesk plugin <= 1.1.2 - Open Redirection VulnerabilityCRM Perks WP Gravity Forms Zendesk
- CVE-2025-47455WordPress Integration for WooCommerce and Salesforce plugin <= 1.7.5 - Open Redirection VulnerabilityCRM Perks Integration for WooCommerce and Salesforce
- CVE-2025-47454WordPress WP Gravity Forms Dynamics CRM plugin <= 1.1.4 - Open Redirection VulnerabilityCRM Perks WP Gravity Forms Dynamics CRM
- CVE-2025-47451WordPress Product Quantity Dropdown For Woocommerce plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilitysilverplugins217 Product Quantity Dropdown For Woocommerce
- CVE-2025-47450WordPress Simple File List plugin <= 6.1.13 - Settings Change VulnerabilityMitchell Bennis Simple File List
- CVE-2025-47449WordPress Meow Gallery plugin <= 5.2.7 - Cross Site Scripting (XSS) VulnerabilityJordy Meow Meow Gallery
- CVE-2025-47448WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) VulnerabilityThimPress WP Hotel Booking
- CVE-2025-47447WordPress Cool Author Box plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) VulnerabilityHossni Mubarak Cool Author Box
- CVE-2025-47446WordPress Listamester plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) VulnerabilityListamester
- CVE-2025-47443WordPress Widget Countdown plugin <= 2.7.4 - Cross Site Scripting (XSS) Vulnerabilitywpdevart Widget Countdown
- CVE-2025-47442WordPress CC BMI Calculator plugin <= 2.1.0 - Cross Site Scripting (XSS) VulnerabilityCC BMI Calculator
- CVE-2025-47441WordPress Progress Bar plugin <= 2.2.3 - Cross Site Scripting (XSS) VulnerabilityChris Reynolds Progress Bar
- CVE-2025-39361WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerabilityWP Royal Royal Elementor Addons
- CVE-2025-27533Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocationApache Software Foundation Apache ActiveMQ · org.apache.… +1
- CVE-2025-20980Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption.Samsung Mobile libsavscmn
- CVE-2025-20978Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege.Samsung Mobile PENUP
- CVE-2025-20977Use of implicit intent for sensitive communication in translation in Samsung Notes prior to version 4.4.29.23 allows local attackers to get Samsung Mobile Samsung Notes
- CVE-2025-20976Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to read out-of-bounds memSamsung Mobile Samsung Notes
- CVE-2025-20975Improper Export of Android Application Components in AODService prior to version 8.8.28.12 allows local attackers to launch arbitrary activiSamsung Mobile AODService
- CVE-2025-20974Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to bypass user interactiSamsung Mobile PackageInstallerCN
- CVE-2025-20973Improper authentication in Secure Folder prior to version 1.8.12.0 in Android 13, and 1.9.21.00 in Android 14 allows physical attackers to rSamsung Mobile Secure Folder
- CVE-2025-20972Improper verification of intent by broadcast receiver in Samsung Flow prior to version 4.9.17.6 allows local attackers to modify Samsung FloSamsung Mobile Samsung Flow
- CVE-2025-20971Improper input validation in Samsung Flow prior to version 4.9.17.6 allows local attackers to access data within Samsung Flow.Samsung Mobile Samsung Flow
- CVE-2025-20970Improper access control in Bixby Vision prior to version 3.8.1 in Android 13, 3.8.3 in Android 14, 3.8.21 in Android 15 allows local attackeSamsung Mobile Bixby Vision
- CVE-2025-20969Improper input validation in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 iSamsung Mobile Samsung Gallery
- CVE-2025-20967Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Samsung Mobile Samsung Gallery
- CVE-2025-20966Improper access control in Samsung Gallery prior to version 14.5.10.3 in Global Android 13, 14.5.09.3 in China Android 13, and 15.5.04.5 in Samsung Mobile Samsung Gallery
- CVE-2025-20965Improper handling of insufficient permission in Bixby wakeup prior to version 2.3.74.8 allows local attackers to access sensitive data.Samsung Mobile Voice wake-up
- CVE-2025-20964Out-of-bounds write in parsing media files in libsavsvc.so prior to SMR May-2025 Release 1 allows local attackers to write out-of-bounds memSamsung Mobile Devices
- CVE-2025-20963Out-of-bounds write in memory initialization in libsavsvc.so prior to SMR May-2025 Release 1 allows local attackers to write out-of-bounds mSamsung Mobile Devices
- CVE-2025-20962Improper handling of insufficient permission in SpenGesture service prior to SMR May-2025 Release 1 allows local attackers to track the S PeSamsung Mobile Devices
- CVE-2025-20961Improper handling of insufficient permission or privileges in sepunion service prior to SMR May-2025 Release 1 allows local privileged attacSamsung Mobile Devices
- CVE-2025-20960Improper handling of insufficient permission in CocktailBarService prior to SMR May-2025 Release 1 allows local attackers to use the privileSamsung Mobile Devices
- CVE-2025-20959Use of implicit intent for sensitive communication in Wi-Fi P2P service prior to SMR May-2025 Release 1 allows local attackers to access senSamsung Mobile Devices
- CVE-2025-20958Improper verification of intent by broadcast receiver in UnifiedWFC prior to SMR May-2025 Release 1 allows local attackers to manipulate VoWSamsung Mobile Devices
- CVE-2025-20956Improper export of android application components in Settings in Galaxy Watch prior to SMR May-2025 Release 1 allows physical attackers to aSamsung Mobile Devices
- CVE-2025-20955Improper Export of Android Application Components in NotificationHistoryImageProvider prior to SMR May-2025 Release 1 allows local attackersSamsung Mobile Devices
- CVE-2025-20954Use of implicit intent for sensitive communication in EnrichedCall prior to SMR May-2025 Release 1 allows local attackers to access sensitivSamsung Mobile Devices
- CVE-2025-20953Improper access control in SmartManagerCN prior to SMR May-2025 Release 1 allows local attackers to launch activities within SmartManagerCN.Samsung Mobile Devices
- CVE-2025-20949Path traversal vulnerability in Samsung Members prior to version 5.0.00.11 allows attackers to read and write arbitrary file with the privilSamsung Mobile Samsung Members
- CVE-2025-20937Out-of-bounds write in Keymaster trustlet prior to SMR May-2025 Release 1 allows local privileged attackers to write out-of-bounds memory.Samsung Mobile Devices
- CVE-2024-12120Royal Elementor Addons and Templates <= 1.7.1017 - Authenticated (Contributor+) Stored Cross-Site Scriptingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2025-4171WZ Followed Posts – Display what visitors are reading <= 3.1.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingajay WZ Followed Posts – Display what visitors are reading
- CVE-2025-32404An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the libraryRT-Labs P-Net
- CVE-2025-32403An Out-of-bounds Write in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the libraryRT-Labs P-Net
- CVE-2025-32401An Heap-based Buffer Overflow in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to corrupt the memory of IO devices that use the RT-Labs P-Net
- CVE-2025-32399An Unchecked Input for Loop Condition in RT-Labs P-Net version 1.0.1 or earlier allows an attacker to cause IO devices that use the library RT-Labs P-Net
- CVE-2025-1400Out-of-bounds Read in libplctag librarylibplctag
- CVE-2025-1399Out-of-bounds Read in libplctag librarylibplctag
- CVE-2025-3766Login Lockdown & Protection <= 2.11 - Missing Authorization to Authenticated (Subscriber+) Arbitrary IP Whitelistingwebfactory Login Lockdown & Protection
- CVE-2025-4054Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search HighlightsRelevanssi Premium · comesio Relevanssi – A Better Search
- CVE-2025-4220Xavin's List Subpages <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingxavinnydek Xavin's List Subpages
- CVE-2025-3860CarDealerPress <= 6.8.2505.00 - Authenticated (Contributor+) Stored Cross-Site Scripting via saleclass Parameterdealertrend CarDealerPress
- CVE-2025-4055Multiple Post Type Order <= 1.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via mpto Shortcodejosj404 Multiple Post Type Order
- CVE-2025-3924PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Missing Authorization to Unauthenticated Email EnumerationPeproDev Ultimate Profile Solutions
- CVE-2025-3851Download Manager and Payment Form WordPress Plugin – WP SmartPay 1.1.0 - 2.7.13 - Authenticated (Subscriber+) Information Exposurethemesgrove Download Manager and Payment Form WordPress Plu…
- CVE-2025-2821Search Exclude <= 2.4.9 - Missing Authorization to Unauthenticated Plugin Settings Modificationquadlayers Search Exclude
- CVE-2025-3853WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generationeoxia WPshop 2 – E-Commerce
- CVE-2025-3218IBM i improper certificate validationIBM i
- CVE-2025-29153SQL Injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the Data export, fil
- CVE-2025-29154HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted
- CVE-2025-29602flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
- CVE-2025-29746Cross Site Scripting vulnerability in Koillection v.1.6.10 allows a remote attacker to escalate privileges via the collection, Wishlist and koillection/koillection
- CVE-2025-45388Wagtail CMS 6.4.1 is vulnerable to a Stored Cross-Site Scripting (XSS) in the document upload functionality.
- CVE-2025-45514Tenda FH451 V1.0.0.9 has a stack overflow vulnerability in the function.frmL7ImForm.
- CVE-2025-47203dbclient in Dropbear SSH before 2025.88 allows command injection via an untrusted hostname argument, because a shell is used.Dropbear SSH Project Dropbear SSH
- CVE-2025-47423Personal Weather Station Dashboard 12_lts allows unauthenticated remote attackers to read arbitrary files via ../ directory traversal in thepwsdashboard Personal Weather Station Dashboard