# CVEs published 2025-06-06

342 CVEs were published on June 6, 2025: 12 critical, 90 high. Days are UTC.

- [CVE-2025-49128](https://cve.now/CVE-2025-49128.md): Jackson-core Vulnerable to Memory Disclosure via Source Snippet in JsonLocation (CVSS 4.0, FasterXML jackson-core · com.fasterxml.jackson.core:jackson…)
- [CVE-2025-49127](https://cve.now/CVE-2025-49127.md): Kafbat UI vulnerable to Remote Code Execution by JMX in Metrices Configuration (CVSS 8.9, kafbat kafka-ui)
- [CVE-2025-5799](https://cve.now/CVE-2025-5799.md): Tenda AC8 WifiExtraSet fromSetWirelessRepeat stack-based overflow (CVSS 8.7, Tenda AC8)
- [CVE-2025-5798](https://cve.now/CVE-2025-5798.md): Tenda AC8 SetSysTimeCfg fromSetSysTime stack-based overflow (CVSS 8.7, Tenda AC8)
- [CVE-2025-5797](https://cve.now/CVE-2025-5797.md): code-projects Laundry System insert\_type.php cross site scripting (CVSS 5.1, code-projects Laundry System)
- [CVE-2025-5796](https://cve.now/CVE-2025-5796.md): code-projects Laundry System edit\_type.php cross site scripting (CVSS 5.1, code-projects Laundry System)
- [CVE-2025-2766](https://cve.now/CVE-2025-2766.md): 70mai A510 Use of Default Password Authentication Bypass Vulnerability (CVSS 8.8, 70mai A510)
- [CVE-2025-3485](https://cve.now/CVE-2025-3485.md): Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, Allegra)
- [CVE-2025-5481](https://cve.now/CVE-2025-5481.md): Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Sante DICOM Viewer Pro)
- [CVE-2025-5480](https://cve.now/CVE-2025-5480.md): Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability (CVSS 7.8, Action1)
- [CVE-2025-5474](https://cve.now/CVE-2025-5474.md): 2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability (CVSS 7.3, 2BrightSparks SyncBackFree)
- [CVE-2025-5473](https://cve.now/CVE-2025-5473.md): GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, GIMP)
- [CVE-2025-5795](https://cve.now/CVE-2025-5795.md): Tenda AC5 AdvSetLanip fromadvsetlanip buffer overflow (CVSS 8.7, Tenda AC5)
- [CVE-2025-5794](https://cve.now/CVE-2025-5794.md): Tenda AC5 setPptpUserList formSetPPTPUserList buffer overflow (CVSS 8.7, Tenda AC5)
- [CVE-2025-5793](https://cve.now/CVE-2025-5793.md): TOTOLINK EX1200T HTTP POST Request formPortFw buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-5792](https://cve.now/CVE-2025-5792.md): TOTOLINK EX1200T HTTP POST Request formWlanRedirect buffer overflow (CVSS 8.7, TOTOLINK EX1200T)
- [CVE-2025-49011](https://cve.now/CVE-2025-49011.md): SpiceDB checks involving relations with caveats can result in no permission when permission is expected (CVSS 3.7, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2025-47950](https://cve.now/CVE-2025-47950.md): CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification (CVSS 7.5, coredns · github.com/coredns/coredns)
- [CVE-2025-5790](https://cve.now/CVE-2025-5790.md): TOTOLINK X15 HTTP POST Request formIpQoS buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5789](https://cve.now/CVE-2025-5789.md): TOTOLINK X15 HTTP POST Request formPortFw buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5788](https://cve.now/CVE-2025-5788.md): TOTOLINK X15 HTTP POST Request formReflashClientTbl buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5787](https://cve.now/CVE-2025-5787.md): TOTOLINK X15 HTTP POST Request formWsc buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5786](https://cve.now/CVE-2025-5786.md): TOTOLINK X15 HTTP POST Request formDMZ buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5785](https://cve.now/CVE-2025-5785.md): TOTOLINK X15 HTTP POST Request formWirelessTbl buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5784](https://cve.now/CVE-2025-5784.md): PHPGurukul Employee Record Management System myexp.php sql injection (CVSS 5.3, PHPGurukul Employee Record Management System)
- [CVE-2025-29885](https://cve.now/CVE-2025-29885.md): File Station 5 (CVSS 8.3, QNAP Systems File Station)
- [CVE-2025-29884](https://cve.now/CVE-2025-29884.md): File Station 5 (CVSS 8.3, QNAP Systems File Station)
- [CVE-2025-29883](https://cve.now/CVE-2025-29883.md): File Station 5 (CVSS 8.3, QNAP Systems File Station)
- [CVE-2025-22486](https://cve.now/CVE-2025-22486.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-29892](https://cve.now/CVE-2025-29892.md): Qsync Central (CVSS 8.7, QNAP Systems Qsync Central)
- [CVE-2025-22482](https://cve.now/CVE-2025-22482.md): Qsync Central (CVSS 2.3, QNAP Systems Qsync Central)
- [CVE-2024-50406](https://cve.now/CVE-2024-50406.md): License Center (CVSS 2.0, QNAP Systems License Center)
- [CVE-2025-22481](https://cve.now/CVE-2025-22481.md): QTS, QuTS hero (CVSS 8.7, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-56805](https://cve.now/CVE-2024-56805.md): QTS, QuTS hero (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2024-13088](https://cve.now/CVE-2024-13088.md): QHora (CVSS 5.2, QNAP Systems QuRouter)
- [CVE-2024-13087](https://cve.now/CVE-2024-13087.md): QHora (CVSS 2.4, QNAP Systems QuRouter)
- [CVE-2025-22484](https://cve.now/CVE-2025-22484.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-22490](https://cve.now/CVE-2025-22490.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29871](https://cve.now/CVE-2025-29871.md): File Station 5 (CVSS 2.4, QNAP Systems File Station)
- [CVE-2025-29872](https://cve.now/CVE-2025-29872.md): File Station 5 (CVSS 7.1, QNAP Systems File Station)
- [CVE-2025-29873](https://cve.now/CVE-2025-29873.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29876](https://cve.now/CVE-2025-29876.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-29877](https://cve.now/CVE-2025-29877.md): File Station 5 (CVSS 5.3, QNAP Systems File Station)
- [CVE-2025-30279](https://cve.now/CVE-2025-30279.md): File Station 5 (CVSS 8.3, QNAP Systems File Station)
- [CVE-2025-33031](https://cve.now/CVE-2025-33031.md): File Station 5 (CVSS 8.3, QNAP Systems File Station)
- [CVE-2025-33035](https://cve.now/CVE-2025-33035.md): File Station 5 (CVSS 7.2, QNAP Systems File Station)
- [CVE-2025-5783](https://cve.now/CVE-2025-5783.md): PHPGurukul Employee Record Management System editmyexp.php sql injection (CVSS 5.3, PHPGurukul Employee Record Management System)
- [CVE-2025-5747](https://cve.now/CVE-2025-5747.md): WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability (CVSS 8.0, WOLFBOX Level 2 EV Charger)
- [CVE-2025-5748](https://cve.now/CVE-2025-5748.md): WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability (CVSS 8.0, WOLFBOX Level 2 EV Charger)
- [CVE-2025-5749](https://cve.now/CVE-2025-5749.md): WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability (CVSS 6.3, WOLFBOX Level 2 EV Charger)
- [CVE-2025-5750](https://cve.now/CVE-2025-5750.md): WOLFBOX Level 2 EV Charger tuya\_svc\_devos\_activate\_result\_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 8.8, WOLFBOX Level 2 EV Charger)
- [CVE-2025-5751](https://cve.now/CVE-2025-5751.md): WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability (CVSS 4.6, WOLFBOX Level 2 EV Charger)
- [CVE-2025-5782](https://cve.now/CVE-2025-5782.md): PHPGurukul Employee Record Management System resetpassword.php sql injection (CVSS 5.3, PHPGurukul Employee Record Management System)
- [CVE-2025-5780](https://cve.now/CVE-2025-5780.md): code-projects Patient Record Management System view\_dental.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-27531](https://cve.now/CVE-2025-27531.md): Apache InLong: An arbitrary file read vulnerability for JDBC (CVSS 9.8, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2025-41646](https://cve.now/CVE-2025-41646.md): RevPi Webstatus application is vulnerable to an authentication bypass (CVSS 9.8, Kunbus Revolution Pi webstatus)
- [CVE-2025-5779](https://cve.now/CVE-2025-5779.md): code-projects Patient Record Management System birthing.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-5778](https://cve.now/CVE-2025-5778.md): 1000 Projects ABC Courier Management System admin sql injection (CVSS 6.9, 1000 Projects ABC Courier Management System)
- [CVE-2025-38002](https://cve.now/CVE-2025-38002.md): io\_uring/fdinfo: grab ctx-\>uring\_lock around io\_uring\_show\_fdinfo() (CVSS 7.8, Linux)
- [CVE-2025-38001](https://cve.now/CVE-2025-38001.md): net\_sched: hfsc: Address reentrant enqueue adding class to eltree twice (CVSS 7.8, Linux)
- [CVE-2025-5806](https://cve.now/CVE-2025-5806.md): Jenkins Gatling Plugin 136.vb\_9009b\_3d33a\_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduc (CVSS 8.0, Jenkins Project Jenkins Gatling Plugin · org.jenkins-ci.plu…)
- [CVE-2025-5791](https://cve.now/CVE-2025-5791.md): Users: \`root\` appended to group listings (CVSS 7.1, rust-users · Red Hat OpenShift sandboxed containers +4)
- [CVE-2025-0620](https://cve.now/CVE-2025-0620.md): Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session (CVSS 4.9, samba · Red Hat Enterprise Linux +1)
- [CVE-2025-38000](https://cve.now/CVE-2025-38000.md): sch\_hfsc: Fix qlen accounting bug when using peek in hfsc\_enqueue() (CVSS 7.8, Linux)
- [CVE-2025-5766](https://cve.now/CVE-2025-5766.md): code-projects Laundry System cross-site request forgery (CVSS 5.3, code-projects Laundry System)
- [CVE-2025-49419](https://cve.now/CVE-2025-49419.md): WordPress Foxit eSign for WordPress plugin \<= 2.0.3 - Other Vulnerability Type Vulnerability (CVSS 5.5, esigngenie Foxit eSign for WordPress)
- [CVE-2025-49421](https://cve.now/CVE-2025-49421.md): WordPress WP Text Expander plugin \<= 1.0.1 - SQL Injection Vulnerability (CVSS 7.6, Andrei Filonov WP Text Expander)
- [CVE-2025-49425](https://cve.now/CVE-2025-49425.md): WordPress Konami Easter Egg plugin \<= v0.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Adrian Hanft Konami Easter Egg)
- [CVE-2025-49427](https://cve.now/CVE-2025-49427.md): WordPress Abbie Expander plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ryan Burnette Abbie Expander)
- [CVE-2025-49429](https://cve.now/CVE-2025-49429.md): WordPress Video Embeds plugin \<= 0.1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ryan Burnette Video Embeds)
- [CVE-2025-49435](https://cve.now/CVE-2025-49435.md): WordPress Wp Easy Allopass plugin \<= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Hasina77 Wp Easy Allopass)
- [CVE-2025-49439](https://cve.now/CVE-2025-49439.md): WordPress Atelier Create CV plugin \<= 1.1.5 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, mariusz88atelierweb Atelier Create CV)
- [CVE-2025-49440](https://cve.now/CVE-2025-49440.md): WordPress WP Security Master plugin \<= 1.0.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Vuong Nguyen WP Security Master)
- [CVE-2025-49441](https://cve.now/CVE-2025-49441.md): WordPress Interactive Regional Map of Florida plugin \<= 1.0 - Broken Access Control Vulnerability (CVSS 5.3, WP Map Plugins Interactive Regional Map of Florida)
- [CVE-2025-49442](https://cve.now/CVE-2025-49442.md): WordPress Simple Nested Menu plugin \<= 1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Mostafa Shahiri Simple Nested Menu)
- [CVE-2025-49443](https://cve.now/CVE-2025-49443.md): WordPress Bacon Ipsum plugin \<= 2.4 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Chris McCoy Bacon Ipsum)
- [CVE-2025-49445](https://cve.now/CVE-2025-49445.md): WordPress Interactive UK Regional Map plugin \<= 2.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, WP Map Plugins Interactive UK Regional Map)
- [CVE-2025-49446](https://cve.now/CVE-2025-49446.md): WordPress Admin Notes plugin \<=1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, minhlaobao Admin Notes)
- [CVE-2025-49449](https://cve.now/CVE-2025-49449.md): WordPress Interactive Regional Map of Africa plugin \<= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, WP Map Plugins Interactive Regional Map of Africa)
- [CVE-2025-49450](https://cve.now/CVE-2025-49450.md): WordPress SEPA Girocode plugin \<= 0.5.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, mhallmann SEPA Girocode)
- [CVE-2025-49453](https://cve.now/CVE-2025-49453.md): WordPress BP Profile as Homepage plugin \<= 1.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Jatinder Pal Singh BP Profile as Homepage)
- [CVE-2023-25995](https://cve.now/CVE-2023-25995.md): WordPress AI Mortgage Calculator \<= 1.0.1 - Local File Inclusion Vulnerability (CVSS 7.5, choicehomemortgage AI Mortgage Calculator)
- [CVE-2023-25997](https://cve.now/CVE-2023-25997.md): WordPress Sola Support Ticket \<= 3.17 - Arbitrary Content Deletion Vulnerability (CVSS 6.5, SolaPlugins Sola Support Ticket)
- [CVE-2023-26000](https://cve.now/CVE-2023-26000.md): WordPress Bang tinh vay \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, hanhdo205 Bang tinh vay)
- [CVE-2023-26001](https://cve.now/CVE-2023-26001.md): WordPress Next Event Calendar \<= 1.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Marchetti Design Next Event Calendar)
- [CVE-2023-26002](https://cve.now/CVE-2023-26002.md): WordPress 6Storage Rentals \<= 2.19.5 - Broken Access Control Vulnerability (CVSS 4.3, 6Storage Rentals)
- [CVE-2023-26003](https://cve.now/CVE-2023-26003.md): WordPress WP Post Corrector \<= 1.0.2 - SQL Injection Vulnerability (CVSS 7.6, vipul Jariwala WP Post Corrector)
- [CVE-2025-23969](https://cve.now/CVE-2025-23969.md): WordPress KI Live Video Conferences plugin \<= 5.5.15 - Sensitive Data Exposure Vulnerability (CVSS 5.3, whassan KI Live Video Conferences)
- [CVE-2025-23971](https://cve.now/CVE-2025-23971.md): WordPress KI Live Video Conferences plugin \<= 5.5.15 - Broken Access Control Vulnerability (CVSS 5.3, whassan KI Live Video Conferences)
- [CVE-2025-24762](https://cve.now/CVE-2025-24762.md): WordPress TicketBAI Facturas para WooCommerce plugin \<= 3.45 - Broken Access Control vulnerability (CVSS 5.4, facturaone TicketBAI Facturas para WooCommerce)
- [CVE-2025-24763](https://cve.now/CVE-2025-24763.md): WordPress bbPress API plugin \<= 1.0.14 - Broken Access Control Vulnerability (CVSS 5.3, Pascal Casier bbPress API)
- [CVE-2025-24772](https://cve.now/CVE-2025-24772.md): WordPress Pay with Contact Form 7 plugin \<= 1.0.4 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, cmsMinds Pay with Contact Form)
- [CVE-2025-24776](https://cve.now/CVE-2025-24776.md): WordPress Responsive Flipbooks plugin \<= 1.0 - Broken Access Control Vulnerability (CVSS 5.4, codelobster Responsive Flipbooks)
- [CVE-2025-24778](https://cve.now/CVE-2025-24778.md): WordPress No Spam At All plugin \<= 1.3 - Broken Access Control Vulnerability (CVSS 5.4, De paragon No Spam At All)
- [CVE-2025-26590](https://cve.now/CVE-2025-26590.md): WordPress Complete Google Seo Scan plugin \<= 3.5.1 - SQL Injection Vulnerability (CVSS 7.6, Nir Complete Google Seo Scan)
- [CVE-2025-26593](https://cve.now/CVE-2025-26593.md): WordPress FastBook plugin \<= 1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, FasterThemes FastBook)
- [CVE-2025-27334](https://cve.now/CVE-2025-27334.md): WordPress Simple Google Static Map plugin \<= 1.0.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Ángel C. Simple Google Static Map)
- [CVE-2025-27359](https://cve.now/CVE-2025-27359.md): WordPress WP Media File Type Manager plugin \<= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Seerox WP Media File Type Manager)
- [CVE-2025-27360](https://cve.now/CVE-2025-27360.md): WordPress Quick Event Calendar plugin \<= 1.4.9 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, WP Corner Quick Event Calendar)
- [CVE-2025-28948](https://cve.now/CVE-2025-28948.md): WordPress Mediabay - WordPress Media Library Folders plugin \<= 1.4 - CSRF to Reflected XSS vulnerability (CVSS 7.1, codedraft Mediabay - WordPress Media Library Folders)
- [CVE-2025-28950](https://cve.now/CVE-2025-28950.md): WordPress Post Author plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, David Shabtai Post Author)
- [CVE-2025-28952](https://cve.now/CVE-2025-28952.md): WordPress CubePoints plugin \<= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Jonathan Lau CubePoints)
- [CVE-2025-28954](https://cve.now/CVE-2025-28954.md): WordPress Backwp plugin \<= 2.0.2 - CSRF to Arbitrary File Deletion vulnerability (CVSS 7.4, wphobby Backwp)
- [CVE-2025-28958](https://cve.now/CVE-2025-28958.md): WordPress Bg Orthodox Calendar plugin \<= 0.13.10 - CSRF to Stored XSS vulnerability (CVSS 7.1, Vadim Bogaiskov Bg Orthodox Calendar)
- [CVE-2025-28964](https://cve.now/CVE-2025-28964.md): WordPress Personal Favicon plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, mangup Personal Favicon)
- [CVE-2025-28966](https://cve.now/CVE-2025-28966.md): WordPress Recent Posts Slider Responsive plugin \<= 1.0.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, dilemma123 Recent Posts Slider Responsive)
- [CVE-2025-28974](https://cve.now/CVE-2025-28974.md): WordPress Free WP Mail SMTP plugin \<= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, mail250 Free WP Mail SMTP)
- [CVE-2025-28981](https://cve.now/CVE-2025-28981.md): WordPress WP Mail Options plugin \<= 0.2.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, Soli WP Mail Options)
- [CVE-2025-28984](https://cve.now/CVE-2025-28984.md): WordPress Subscription Renewal Reminders for WooCommerce plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, storepro Subscription Renewal Reminders for WooCommerce)
- [CVE-2025-28985](https://cve.now/CVE-2025-28985.md): WordPress Elastic Email Subscribe Form plugin \<= 1.2.2 - Broken Access Control Vulnerability (CVSS 5.4, Elastic Email Subscribe Form)
- [CVE-2025-28986](https://cve.now/CVE-2025-28986.md): WordPress Epicwin Plugin plugin \<= 1.5 - CSRF to SQL Injection vulnerability (CVSS 8.2, Webaholicson Epicwin Plugin)
- [CVE-2025-28989](https://cve.now/CVE-2025-28989.md): WordPress Read More Login plugin \<= 2.0.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, arildur Read More Login)
- [CVE-2025-28994](https://cve.now/CVE-2025-28994.md): WordPress Viral Loops WP Integration plugin \<= 3.8.1 - Broken Access Control Vulnerability (CVSS 4.3, viralloops Viral Loops WP Integration)
- [CVE-2025-28995](https://cve.now/CVE-2025-28995.md): WordPress Viral Loops WP Integration plugin \<= 3.8.1 - Broken Access Control Vulnerability (CVSS 5.3, viralloops Viral Loops WP Integration)
- [CVE-2025-28996](https://cve.now/CVE-2025-28996.md): WordPress GPP Slideshow plugin \<= 1.3.5 - Broken Access Control Vulnerability (CVSS 4.3, Thad Allender GPP Slideshow)
- [CVE-2025-28997](https://cve.now/CVE-2025-28997.md): WordPress WP AutoKeyword plugin \<= 1.0 - Broken Access Control Vulnerability (CVSS 5.3, EXEIdeas International WP AutoKeyword)
- [CVE-2025-29003](https://cve.now/CVE-2025-29003.md): WordPress The Holiday Calendar plugin \<= 1.18.2.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, mva7 The Holiday Calendar)
- [CVE-2025-29005](https://cve.now/CVE-2025-29005.md): WordPress HR Management Lite plugin \<= 3.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Weblizar - WordPress Themes & Plugin HR Management Lite)
- [CVE-2025-29006](https://cve.now/CVE-2025-29006.md): WordPress Direct Checkout for WooCommerce Lite plugin \<= 1.0.3 - Broken Access Control Vulnerability (CVSS 5.3, centangle Direct Checkout for WooCommerce Lite)
- [CVE-2025-29008](https://cve.now/CVE-2025-29008.md): WordPress SocialMark plugin \<= 2.0.7 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 4.9, ShawonPro SocialMark)
- [CVE-2025-29010](https://cve.now/CVE-2025-29010.md): WordPress Behance Portfolio Manager plugin \<= 1.7.5 - Broken Access Control vulnerability (CVSS 4.3, eleopard Behance Portfolio Manager)
- [CVE-2025-29011](https://cve.now/CVE-2025-29011.md): WordPress YouTube Simple Gallery plugin \<= 2.2.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CHR Designer YouTube Simple Gallery)
- [CVE-2025-29013](https://cve.now/CVE-2025-29013.md): WordPress Custom Category/Post Type Post order plugin \<= 1.6.0 - Broken Access Control Vulnerability (CVSS 5.4, faaiq Custom Category/Post Type Post order)
- [CVE-2025-30624](https://cve.now/CVE-2025-30624.md): WordPress WordLift plugin \<= 3.54.4 - Broken Access Control Vulnerability (CVSS 4.3, WordLift)
- [CVE-2025-30625](https://cve.now/CVE-2025-30625.md): WordPress AppBanners plugin \<= 1.5.14 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Matt Pramschufer AppBanners)
- [CVE-2025-30627](https://cve.now/CVE-2025-30627.md): WordPress Elegant Visitor Counter plugin \<= 3.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, regolithsjk Elegant Visitor Counter)
- [CVE-2025-30629](https://cve.now/CVE-2025-30629.md): WordPress Bitly URL Shortener plugin \<= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Codehaveli Bitly URL Shortener)
- [CVE-2025-30630](https://cve.now/CVE-2025-30630.md): WordPress Global Translator plugin \<= 2.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, pozzad Global Translator)
- [CVE-2025-30632](https://cve.now/CVE-2025-30632.md): WordPress Global Translator plugin \<= 2.0.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, pozzad Global Translator)
- [CVE-2025-30634](https://cve.now/CVE-2025-30634.md): WordPress WP Featured Content Slider plugin \<= 2.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, IWEBIX WP Featured Content Slider)
- [CVE-2025-30636](https://cve.now/CVE-2025-30636.md): WordPress Accessibility Suite plugin \<= 4.19 - Broken Access Control Vulnerability (CVSS 5.4, Ability Accessibility Suite)
- [CVE-2025-30637](https://cve.now/CVE-2025-30637.md): WordPress Booking Ultra Pro plugin \<= 1.1.20 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Deetronix Booking Ultra Pro)
- [CVE-2025-30638](https://cve.now/CVE-2025-30638.md): WordPress Powie's Uptime Robot plugin \<= 0.9.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, PowieT Powie's Uptime Robot)
- [CVE-2025-30927](https://cve.now/CVE-2025-30927.md): WordPress Wordapp plugin \<= 1.7.0 - Broken Access Control Vulnerability (CVSS 4.3, Wordapp Team Wordapp)
- [CVE-2025-30928](https://cve.now/CVE-2025-30928.md): WordPress WP Biographia plugin \<= 4.0.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, vicchi WP Biographia)
- [CVE-2025-30930](https://cve.now/CVE-2025-30930.md): WordPress ACF: Yandex Maps Field plugin \<= 1.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Unreal Themes ACF: Yandex Maps Field)
- [CVE-2025-30931](https://cve.now/CVE-2025-30931.md): WordPress «Подсказки» от DaData.ru plugin \<= 1.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Shamil Shafeev «Подсказки» от DaData.ru)
- [CVE-2025-30932](https://cve.now/CVE-2025-30932.md): WordPress WP Compress for MainWP plugin \<= 6.30.32 - Broken Access Control Vulnerability (CVSS 5.4, WP Compress for MainWP)
- [CVE-2025-30934](https://cve.now/CVE-2025-30934.md): WordPress 診断ジェネレータ作成プラグイン plugin \<= 1.4.16 - Broken Access Control Vulnerability (CVSS 5.3, OLIVESYSTEM 診断ジェネレータ作成プラグイン)
- [CVE-2025-30935](https://cve.now/CVE-2025-30935.md): WordPress Contact Form plugin \<= 2.0.12 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, NickDuncan Contact Form)
- [CVE-2025-30937](https://cve.now/CVE-2025-30937.md): WordPress Responsify WP plugin \<= 1.9.11 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, stefanledin Responsify WP)
- [CVE-2025-30938](https://cve.now/CVE-2025-30938.md): WordPress Broadly for WordPress plugin \<= 3.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Broadly for WordPress)
- [CVE-2025-30939](https://cve.now/CVE-2025-30939.md): WordPress IFrame Widget plugin \<= 4.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Debashish IFrame Widget)
- [CVE-2025-30940](https://cve.now/CVE-2025-30940.md): WordPress Melipayamak plugin \<= 2.2.12 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Melipayamak)
- [CVE-2025-30941](https://cve.now/CVE-2025-30941.md): WordPress Pinterest Verify Meta Tag plugin \<= 1.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Marvie Pons Pinterest Verify Meta Tag)
- [CVE-2025-30942](https://cve.now/CVE-2025-30942.md): WordPress Post Custom Templates Lite plugin \<= 1.14 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, OTWthemes Post Custom Templates Lite)
- [CVE-2025-30945](https://cve.now/CVE-2025-30945.md): WordPress Taskbuilder plugin \<= 4.0.7 - Broken Access Control Vulnerability (CVSS 5.3, Taskbuilder)
- [CVE-2025-30946](https://cve.now/CVE-2025-30946.md): WordPress Custom Bulk/Quick Edit plugin \<= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Michael Cannon Custom Bulk/Quick Edit)
- [CVE-2025-30948](https://cve.now/CVE-2025-30948.md): WordPress Layouts for Elementor plugin \<= 1.11 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Giraphix Creative Layouts for Elementor)
- [CVE-2025-30950](https://cve.now/CVE-2025-30950.md): WordPress All Currencies for WooCommerce plugin \<= 2.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Wham All Currencies for WooCommerce)
- [CVE-2025-30951](https://cve.now/CVE-2025-30951.md): WordPress BlockStrap Page Builder - Bootstrap Blocks plugin \<= 0.1.36 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Stiofan BlockStrap Page Builder - Bootstrap Blocks)
- [CVE-2025-30952](https://cve.now/CVE-2025-30952.md): WordPress Nexa Blocks plugin \<= 1.1.0 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpdive Nexa Blocks)
- [CVE-2025-30953](https://cve.now/CVE-2025-30953.md): WordPress WP Gravity Forms Salesforce plugin \<= 1.4.7 - Open Redirection Vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms Salesforce)
- [CVE-2025-30954](https://cve.now/CVE-2025-30954.md): WordPress WP Gravity Forms Constant Contact Plugin \<= 1.1.0 - Open Redirection Vulnerability (CVSS 4.7, CRM Perks WP Gravity Forms Constant Contact Plugin)
- [CVE-2025-30956](https://cve.now/CVE-2025-30956.md): WordPress Booqable Rental plugin \<= 2.4.25 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Booqable Rental Software Booqable Rental)
- [CVE-2025-30957](https://cve.now/CVE-2025-30957.md): WordPress Activity Plus Reloaded for BuddyPress plugin \<= 1.1.2 - Broken Access Control Vulnerability (CVSS 5.4, BuddyDev Activity Plus Reloaded for BuddyPress)
- [CVE-2025-30958](https://cve.now/CVE-2025-30958.md): WordPress onOffice for WP-Websites plugin \<= 6.5.1 - Broken Access Control vulnerability (CVSS 5.4, onOffice for WP-Websites)
- [CVE-2025-30968](https://cve.now/CVE-2025-30968.md): WordPress Advanced Post List plugin \<= 0.5.6.2 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, jokerbr313 Advanced Post List)
- [CVE-2025-30974](https://cve.now/CVE-2025-30974.md): WordPress Post Grid Master plugin \<= 3.4.17 - Broken Access Control vulnerability (CVSS 4.3, Akhtarujjaman Shuvo Post Grid Master)
- [CVE-2025-30976](https://cve.now/CVE-2025-30976.md): WordPress Nexa Blocks plugin \<= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.9, wpdive Nexa Blocks)
- [CVE-2025-30977](https://cve.now/CVE-2025-30977.md): WordPress Chaport \<= 1.1.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, Chaport Live Chat Chaport)
- [CVE-2025-30978](https://cve.now/CVE-2025-30978.md): WordPress Slack Notifications by dorzki plugin \<= 2.0.7 - Broken Access Control Vulnerability (CVSS 4.3, Dor Zuberi Slack Notifications by dorzki)
- [CVE-2025-30980](https://cve.now/CVE-2025-30980.md): WordPress Simple Keyword to Link plugin \<= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Alessandro Piconi Simple Keyword to Link)
- [CVE-2025-30981](https://cve.now/CVE-2025-30981.md): WordPress WP-Recall plugin \<= 16.26.14 - CSRF to Privilege Escalation vulnerability (CVSS 6.3, tggfref WP-Recall)
- [CVE-2025-30986](https://cve.now/CVE-2025-30986.md): WordPress Elite Video Player plugin \<= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, \_CreativeMedia\_ Elite Video Player)
- [CVE-2025-30989](https://cve.now/CVE-2025-30989.md): WordPress Libro de Reclamaciones y Quejas plugin \<= 0.9 - SQL Injection Vulnerability (CVSS 7.6, Renzo Tejada Libro de Reclamaciones y Quejas)
- [CVE-2025-30990](https://cve.now/CVE-2025-30990.md): WordPress ThemeHunk plugin \<= 1.2.0 - Broken Access Control vulnerability (CVSS 4.3, ThemeHunk)
- [CVE-2025-30991](https://cve.now/CVE-2025-30991.md): WordPress Premium Packages plugin \<= 6.0.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Shahjada WPDM – Premium Packages)
- [CVE-2025-30994](https://cve.now/CVE-2025-30994.md): WordPress CubeWP plugin \<= 1.1.29 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Imran Tauqeer CubeWP)
- [CVE-2025-30995](https://cve.now/CVE-2025-30995.md): WordPress Widgetize Pages Light plugin \<= 3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability (CVSS 7.1, OTWthemes Widgetize Pages Light)
- [CVE-2025-30997](https://cve.now/CVE-2025-30997.md): WordPress Car Repair Services theme \<= 5.0 - Server Side Request Forgery (SSRF) Vulnerability (CVSS 5.4, SmartDataSoft Car Repair Services)
- [CVE-2025-30999](https://cve.now/CVE-2025-30999.md): WordPress External Store for Shopify plugin \<= 1.5.9 - Local File Inclusion vulnerability (CVSS 7.5, Fahad Mahmood External Store for Shopify)
- [CVE-2025-31000](https://cve.now/CVE-2025-31000.md): WordPress Payment QR WooCommerce plugin \<= 1.1.6 - Broken Access Control Vulnerability (CVSS 5.3, Miguel Fuentes Payment QR WooCommerce)
- [CVE-2025-31025](https://cve.now/CVE-2025-31025.md): WordPress Image Hover Effects Block plugin \<= 1.4.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Blocksera Image Hover Effects Block)
- [CVE-2025-49333](https://cve.now/CVE-2025-49333.md): WordPress Simple Membership plugin \<= 4.6.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, wp.insider Simple Membership)
- [CVE-2025-49332](https://cve.now/CVE-2025-49332.md): WordPress WP Time Slots Booking Form plugin \<= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, codepeople WP Time Slots Booking Form)
- [CVE-2025-49329](https://cve.now/CVE-2025-49329.md): WordPress Store Locator WordPress plugin \<= 1.5.2 - Arbitrary File Upload Vulnerability (CVSS 6.6, Agile Logix Store Locator WordPress)
- [CVE-2025-49328](https://cve.now/CVE-2025-49328.md): WordPress Store Locator WordPress plugin \<= 1.5.1 - SQL Injection Vulnerability (CVSS 7.6, Agile Logix Store Locator WordPress)
- [CVE-2025-49327](https://cve.now/CVE-2025-49327.md): WordPress ShortLinks Pro plugin \<= 1.0.7 - SQL Injection Vulnerability (CVSS 7.6, Ruben Garcia ShortLinks Pro)
- [CVE-2025-49326](https://cve.now/CVE-2025-49326.md): WordPress GamiPress plugin \<= 7.4.5 - SQL Injection Vulnerability (CVSS 7.6, Ruben Garcia GamiPress)
- [CVE-2025-49325](https://cve.now/CVE-2025-49325.md): WordPress Newspack Newsletters plugin \<= 3.13.0 - Open Redirection Vulnerability (CVSS 4.7, Automattic Newspack Newsletters)
- [CVE-2025-49324](https://cve.now/CVE-2025-49324.md): WordPress Job Board Manager plugin \<= 2.1.60 - Broken Access Control Vulnerability (CVSS 5.3, PickPlugins Job Board Manager)
- [CVE-2025-49323](https://cve.now/CVE-2025-49323.md): WordPress Hydra Booking plugin \<= 1.1.10 - SQL Injection Vulnerability (CVSS 8.5, Themefic Hydra Booking)
- [CVE-2025-49322](https://cve.now/CVE-2025-49322.md): WordPress 404 Page by SeedProd \< 1.0.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, 404 Page by SeedProd)
- [CVE-2025-49320](https://cve.now/CVE-2025-49320.md): WordPress FraudLabs Pro for WooCommerce plugin \<= 2.22.11 - Broken Access Control Vulnerability (CVSS 5.3, fraudlabspro FraudLabs Pro for WooCommerce)
- [CVE-2025-49318](https://cve.now/CVE-2025-49318.md): WordPress WPtouch plugin \<= 4.3.60 - Cross Site Scripting (XSS) Vulnerability (CVSS 5.9, WPtouch)
- [CVE-2025-49317](https://cve.now/CVE-2025-49317.md): WordPress WP Page Loading plugin \<= 1.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, NTC WP Page Loading)
- [CVE-2025-49315](https://cve.now/CVE-2025-49315.md): WordPress Persian Woocommerce SMS plugin \<= 7.0.10 - SQL Injection Vulnerability (CVSS 7.6, PersianScript Persian Woocommerce SMS)
- [CVE-2025-49314](https://cve.now/CVE-2025-49314.md): WordPress BRW plugin \<= 1.8.6 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, ovatheme BRW)
- [CVE-2025-49313](https://cve.now/CVE-2025-49313.md): WordPress BRW plugin \<= 1.8.6 - Local File Inclusion Vulnerability (CVSS 7.5, ovatheme BRW)
- [CVE-2025-49311](https://cve.now/CVE-2025-49311.md): WordPress The Events Calendar Countdown Addon plugin \<= 1.4.9 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CoolHappy The Events Calendar Countdown Addon)
- [CVE-2025-49310](https://cve.now/CVE-2025-49310.md): WordPress Frontend Dashboard plugin \<= 2.2.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, M A Vinoth Kumar Frontend Dashboard)
- [CVE-2025-49309](https://cve.now/CVE-2025-49309.md): WordPress HT Team Member plugin \<= 1.1.7 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, HT Plugins HT Team Member)
- [CVE-2025-49308](https://cve.now/CVE-2025-49308.md): WordPress WP Travel Engine plugin \<= 6.5.1 - Local File Inclusion Vulnerability (CVSS 7.5, WP Travel Engine)
- [CVE-2025-49307](https://cve.now/CVE-2025-49307.md): WordPress WP Multilang plugin \<= 2.4.19 - Local File Inclusion Vulnerability (CVSS 7.5, Magazine3 WP Multilang)
- [CVE-2025-49306](https://cve.now/CVE-2025-49306.md): WordPress WP Social Widget plugin \<= 2.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, catchsquare WP Social Widget)
- [CVE-2025-49305](https://cve.now/CVE-2025-49305.md): WordPress Product Catalog Simple plugin \<= 1.8.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, impleCode Product Catalog Simple)
- [CVE-2025-49304](https://cve.now/CVE-2025-49304.md): WordPress Search with Typesense plugin \<= 2.0.10 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, CodeManas Search with Typesense)
- [CVE-2025-49301](https://cve.now/CVE-2025-49301.md): WordPress Greenshift plugin \<= 11.5.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, wpsoul Greenshift)
- [CVE-2025-49299](https://cve.now/CVE-2025-49299.md): WordPress WebHotelier plugin \<= 1.9.2 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, WPlugged.com WebHotelier)
- [CVE-2025-49298](https://cve.now/CVE-2025-49298.md): WordPress Event post plugin \<= 5.10.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Bastien Ho Event post)
- [CVE-2025-49294](https://cve.now/CVE-2025-49294.md): WordPress Crawlomatic Multisite Scraper Post Generator plugin \<= 2.6.8.2 - Sensitive Data Exposure via Log Exposure vulnerability (CVSS 5.3, CodeRevolution Crawlomatic Multisite Scraper Post Generator)
- [CVE-2025-49293](https://cve.now/CVE-2025-49293.md): WordPress Crawlomatic Multisite Scraper Post Generator plugin \<= 2.6.8.2 - Broken Access Control Vulnerability (CVSS 4.3, CodeRevolution Crawlomatic Multisite Scraper Post Generator)
- [CVE-2025-49292](https://cve.now/CVE-2025-49292.md): WordPress Profile Builder plugin \<= 3.13.8 - Content Spoofing Vulnerability (CVSS 4.3, Cozmoslabs Profile Builder)
- [CVE-2025-49291](https://cve.now/CVE-2025-49291.md): WordPress Calculated Fields Form plugin \<= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, codepeople Calculated Fields Form)
- [CVE-2025-49289](https://cve.now/CVE-2025-49289.md): WordPress PDF for WPForms plugin \<= 5.5.0 - Broken Access Control Vulnerability (CVSS 5.0, add-ons.org PDF for WPForms)
- [CVE-2025-49288](https://cve.now/CVE-2025-49288.md): WordPress Ultimate WP Mail plugin \<= 1.3.5 - Account Takeover via Email Log Leak Vulnerability (CVSS 8.8, Rustaurius Ultimate WP Mail)
- [CVE-2025-49287](https://cve.now/CVE-2025-49287.md): WordPress Product Feed for WooCommerce plugin \<= 2.2.8 - Broken Access Control Vulnerability (CVSS 4.3, WebToffee Product Feed for WooCommerce)
- [CVE-2025-49286](https://cve.now/CVE-2025-49286.md): WordPress WP Table Builder plugin \<= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, WP Table Builder)
- [CVE-2025-49285](https://cve.now/CVE-2025-49285.md): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin \<= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy C…)
- [CVE-2025-49284](https://cve.now/CVE-2025-49284.md): WordPress WP Maintenance Mode & Site Under Construction plugin \<= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, wp-buy WP Maintenance Mode & Site Under Construction)
- [CVE-2025-49283](https://cve.now/CVE-2025-49283.md): WordPress Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant plugin \<= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for…)
- [CVE-2025-49273](https://cve.now/CVE-2025-49273.md): WordPress WP Tools plugin \<= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, sminozzi WP Tools)
- [CVE-2025-49272](https://cve.now/CVE-2025-49272.md): WordPress Trinity Audio plugin \<= 5.20.0 - Broken Access Control Vulnerability (CVSS 4.3, sergiotrinity Trinity Audio)
- [CVE-2025-49270](https://cve.now/CVE-2025-49270.md): WordPress WP-CRM System plugin \<= 3.4.2 - Broken Access Control Vulnerability (CVSS 5.3, Mario Peshev WP-CRM System)
- [CVE-2025-49269](https://cve.now/CVE-2025-49269.md): WordPress Market Exporter plugin \<= 2.0.22 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, Anton Vanyukov Market Exporter)
- [CVE-2025-49268](https://cve.now/CVE-2025-49268.md): WordPress Verge3D plugin \<= 4.9.4 - Broken Access Control Vulnerability (CVSS 5.3, Soft8Soft Verge3D)
- [CVE-2025-49263](https://cve.now/CVE-2025-49263.md): WordPress WC Vendors Marketplace plugin \<= 2.5.6 - SQL Injection Vulnerability (CVSS 7.6, WCVendors WC Vendors Marketplace)
- [CVE-2025-49262](https://cve.now/CVE-2025-49262.md): WordPress Sina Extension for Elementor plugin \<= 3.6.1 - Cross Site Scripting (XSS) Vulnerability (CVSS 7.6, shaonsina Sina Extension for Elementor)
- [CVE-2025-49250](https://cve.now/CVE-2025-49250.md): WordPress Team Showcase plugin \< 25.05.13 - Arbitrary Shortcode Execution vulnerability (CVSS 4.3, cmoreira Team Showcase)
- [CVE-2025-49248](https://cve.now/CVE-2025-49248.md): WordPress Team Showcase plugin \< 25.05.13 - Broken Access Control Vulnerability (CVSS 4.3, cmoreira Team Showcase)
- [CVE-2025-49246](https://cve.now/CVE-2025-49246.md): WordPress Testimonials Showcase plugin \<= 1.9.16 - Broken Access Control Vulnerability (CVSS 4.3, cmoreira Testimonials Showcase)
- [CVE-2025-49244](https://cve.now/CVE-2025-49244.md): WordPress Shortcodes Ultimate plugin \<= 7.3.5 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, Vova Shortcodes Ultimate)
- [CVE-2025-49243](https://cve.now/CVE-2025-49243.md): WordPress ShiftNav – Responsive Mobile Menu plugin \<= 1.8 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, sevenspark ShiftNav – Responsive Mobile Menu)
- [CVE-2025-49242](https://cve.now/CVE-2025-49242.md): WordPress Bellows Accordion Menu plugin \<= 1.4.3 - Cross Site Scripting (XSS) Vulnerability (CVSS 6.5, sevenspark Bellows Accordion Menu)
- [CVE-2025-49241](https://cve.now/CVE-2025-49241.md): WordPress oik plugin \<= 4.15.1 - Broken Access Control Vulnerability (CVSS 5.3, bobbingwide oik)
- [CVE-2025-49240](https://cve.now/CVE-2025-49240.md): WordPress DocsPress plugin \<= 2.5.2 - Broken Access Control Vulnerability (CVSS 4.3, nK DocsPress)
- [CVE-2025-49239](https://cve.now/CVE-2025-49239.md): WordPress Print Invoice & Delivery Notes for WooCommerce plugin \<= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 5.4, tychesoftwares Print Invoice & Delivery Notes for WooCommer…)
- [CVE-2025-49238](https://cve.now/CVE-2025-49238.md): WordPress Everest Backup plugin \<= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 4.3, everestthemes Everest Backup)
- [CVE-2025-49237](https://cve.now/CVE-2025-49237.md): WordPress POEditor plugin \<= 0.9.10 - CSRF to Arbitrary File Deletion vulnerability (CVSS 7.4, POEditor)
- [CVE-2025-49236](https://cve.now/CVE-2025-49236.md): WordPress Raychat plugin \<= 2.1.0 - Broken Access Control Vulnerability (CVSS 5.3, Raychat)
- [CVE-2025-49235](https://cve.now/CVE-2025-49235.md): WordPress RTMKit Addons for Elementor plugin \<= 1.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rometheme RTMKit)
- [CVE-2025-5765](https://cve.now/CVE-2025-5765.md): code-projects Laundry System edit\_laundry.php cross site scripting (CVSS 5.1, code-projects Laundry System)
- [CVE-2025-5764](https://cve.now/CVE-2025-5764.md): code-projects Laundry System insert\_laundry.php cross site scripting (CVSS 5.1, code-projects Laundry System)
- [CVE-2025-49072](https://cve.now/CVE-2025-49072.md): WordPress Mr. Murphy \< 1.2.12.1 - PHP Object Injection Vulnerability (CVSS 9.8, AncoraThemes Mr. Murphy)
- [CVE-2025-49073](https://cve.now/CVE-2025-49073.md): WordPress Sweet Dessert \< 1.1.13 - PHP Object Injection Vulnerability (CVSS 9.8, axiomthemes Sweet Dessert)
- [CVE-2025-5763](https://cve.now/CVE-2025-5763.md): Tenda CP3 apollo sub\_F3C8C command injection (CVSS 5.1, Tenda CP3)
- [CVE-2025-5762](https://cve.now/CVE-2025-5762.md): code-projects Patient Record Management System view\_hematology.php sql injection (CVSS 5.3, code-projects Patient Record Management System)
- [CVE-2025-41361](https://cve.now/CVE-2025-41361.md): Uncontrolled resource consumption vulnerability in IDF and ZLF (CVSS 8.3, ZIV IDF and ZLF)
- [CVE-2025-41367](https://cve.now/CVE-2025-41367.md): Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF (CVSS 4.8, ZIV IDF and ZLF)
- [CVE-2025-41366](https://cve.now/CVE-2025-41366.md): CORS vulnerability in IDF and ZLF (CVSS 5.1, ZIV IDF and ZLF)
- [CVE-2025-41365](https://cve.now/CVE-2025-41365.md): Code injection vulnerability in IDF and ZLF (CVSS 5.1, ZIV IDF and ZLF)
- [CVE-2025-41364](https://cve.now/CVE-2025-41364.md): Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF (CVSS 5.1, ZIV IDF and ZLF)
- [CVE-2025-48329](https://cve.now/CVE-2025-48329.md): WordPress Real Time Validation for Gravity Forms plugin \<= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Daman Jeet Real Time Validation for Gravity Forms)
- [CVE-2025-41363](https://cve.now/CVE-2025-41363.md): CORS vulnerability in IDF and ZLF (CVSS 5.3, ZIV IDF and ZLF)
- [CVE-2025-39358](https://cve.now/CVE-2025-39358.md): WordPress WP Posts Carousel \<= 1.3.12 - PHP Object Injection Vulnerability (CVSS 8.8, teastudio.pl WP Posts Carousel)
- [CVE-2025-41362](https://cve.now/CVE-2025-41362.md): Code injection vulnerability in IDF and ZLF (CVSS 5.3, ZIV IDF and ZLF)
- [CVE-2025-47584](https://cve.now/CVE-2025-47584.md): WordPress Photography theme \<= 7.5.2 - PHP Object Injection vulnerability (CVSS 8.5, ThemeGoods Photography)
- [CVE-2025-41360](https://cve.now/CVE-2025-41360.md): Uncontrolled resource consumption vulnerability in IDF and ZLF (CVSS 8.7, ZIV IDF and ZLF)
- [CVE-2025-47586](https://cve.now/CVE-2025-47586.md): WordPress Motors - Events plugin \<= 1.4.7 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, StylemixThemes Motors - Events)
- [CVE-2025-48335](https://cve.now/CVE-2025-48335.md): WordPress Responsive Plus plugin \<= 3.2.0 - Broken Access Control vulnerability (CVSS 5.4, CyberChimps Responsive Plus)
- [CVE-2025-48328](https://cve.now/CVE-2025-48328.md): WordPress Real Time Validation for Gravity Forms plugin \<= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 4.3, Daman Jeet Real Time Validation for Gravity Forms)
- [CVE-2025-49076](https://cve.now/CVE-2025-49076.md): WordPress The Plus Addons for Elementor Page Builder Lite plugin \<= 6.2.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, POSIMYTH The Plus Addons for Elementor Page Builder Lite)
- [CVE-2025-49075](https://cve.now/CVE-2025-49075.md): WordPress Wishlist plugin \<= 1.0.43 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PickPlugins Wishlist)
- [CVE-2025-49074](https://cve.now/CVE-2025-49074.md): WordPress WidgetKit plugin \<= 2.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Abu Huraira Bin Aman WidgetKit)
- [CVE-2025-49068](https://cve.now/CVE-2025-49068.md): WordPress Ocean Extra plugin \<= 2.4.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, oceanwp Ocean Extra)
- [CVE-2025-49067](https://cve.now/CVE-2025-49067.md): WordPress Nasa Core plugin \< 6.4.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, NasaTheme Nasa Core)
- [CVE-2025-5761](https://cve.now/CVE-2025-5761.md): PHPGurukul BP Monitoring Management System edit-family-member.php sql injection (CVSS 5.3, PHPGurukul BP Monitoring Management System)
- [CVE-2025-49077](https://cve.now/CVE-2025-49077.md): WordPress Dynamic Pricing and Discount Rules plugin \<= 2.2.9 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ThemeHigh Dynamic Pricing and Discount Rules)
- [CVE-2025-48337](https://cve.now/CVE-2025-48337.md): WordPress QuickCab plugin \<= 1.3.3 - Broken Access Control vulnerability (CVSS 5.3, QuickcabWP QuickCab)
- [CVE-2025-5239](https://cve.now/CVE-2025-5239.md): Domain For Sale \<= 3.0.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via class\_name Parameter (CVSS 6.4, themeatelier Domain For Sale – Sell Domains with Landing Pa…)
- [CVE-2025-5760](https://cve.now/CVE-2025-5760.md): Simple History \<= 5.8.1 - Authenticated (Administrator+) Sensitive Information Exposure via Detective Mode (CVSS 4.9, eskapism Simple History – Track, Log, and Audit WordPress C…)
- [CVE-2025-5759](https://cve.now/CVE-2025-5759.md): PHPGurukul Local Services Search Engine Management System edit-person-detail.php sql injection (CVSS 6.9, PHPGurukul Local Services Search Engine Management System)
- [CVE-2025-5758](https://cve.now/CVE-2025-5758.md): SourceCodester Open Source Clinic Management System doctor.php sql injection (CVSS 6.9, SourceCodester Open Source Clinic Management System)
- [CVE-2025-5757](https://cve.now/CVE-2025-5757.md): code-projects Traffic Offense Reporting System save-reported.php cross site scripting (CVSS 5.1, code-projects Traffic Offense Reporting System)
- [CVE-2025-5756](https://cve.now/CVE-2025-5756.md): code-projects Real Estate Property Management System EditCity.php sql injection (CVSS 6.9, code-projects Real Estate Property Management System)
- [CVE-2025-5755](https://cve.now/CVE-2025-5755.md): SourceCodester Open Source Clinic Management System email\_config.php sql injection (CVSS 6.9, SourceCodester Open Source Clinic Management System)
- [CVE-2025-48784](https://cve.now/CVE-2025-48784.md): Soar Cloud HRD Human Resource Management System - Missing Authorization (CVSS 8.8, Soar Cloud System CO. HRD Human Resource Management System)
- [CVE-2025-48783](https://cve.now/CVE-2025-48783.md): Soar Cloud HRD Human Resource Management System - External Control of File Name or Path (CVSS 8.8, Soar Cloud System CO. HRD Human Resource Management System)
- [CVE-2025-48782](https://cve.now/CVE-2025-48782.md): Soar Cloud HRD Human Resource Management System - Unrestricted Upload of File with Dangerous Type (CVSS 9.9, Soar Cloud System CO. HRD Human Resource Management System)
- [CVE-2025-48781](https://cve.now/CVE-2025-48781.md): Soar Cloud HRD Human Resource Management System - External Control of File Name or Path (CVSS 8.7, Soar Cloud System CO. HRD Human Resource Management System)
- [CVE-2025-48780](https://cve.now/CVE-2025-48780.md): Soar Cloud HRD Human Resource Management System - Deserialization of Untrusted Data (CVSS 9.9, Soar Cloud System CO. HRD Human Resource Management System)
- [CVE-2025-5192](https://cve.now/CVE-2025-5192.md): Soar Cloud HRD Human Resource Management System - Missing Authentication for Critical Function (CVSS 9.3, Soar Cloud System CO. HRD Human Resource Management System)
- [CVE-2025-5739](https://cve.now/CVE-2025-5739.md): TOTOLINK X15 HTTP POST Request formSaveConfig buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5738](https://cve.now/CVE-2025-5738.md): TOTOLINK X15 HTTP POST Request formStats buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5737](https://cve.now/CVE-2025-5737.md): TOTOLINK X15 HTTP POST Request formDosCfg buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-3365](https://cve.now/CVE-2025-3365.md): Relative Path Traversal in OnlineSuite (CVSS 9.8, B. Braun Melsungen AG OnlineSuite)
- [CVE-2025-3322](https://cve.now/CVE-2025-3322.md): Improper Neutralization of Special Elements in OnlineSuite (CVSS 10.0, B. Braun Melsungen AG OnlineSuite)
- [CVE-2025-3321](https://cve.now/CVE-2025-3321.md): Use of Hard-coded Credentials in OnlineSuite (CVSS 9.4, B. Braun Melsungen AG OnlineSuite)
- [CVE-2025-5736](https://cve.now/CVE-2025-5736.md): TOTOLINK X15 HTTP POST Request formNtp buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5735](https://cve.now/CVE-2025-5735.md): TOTOLINK X15 HTTP POST Request formSetLg buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5734](https://cve.now/CVE-2025-5734.md): TOTOLINK X15 HTTP POST Request formWlanRedirect buffer overflow (CVSS 8.7, TOTOLINK X15)
- [CVE-2025-5732](https://cve.now/CVE-2025-5732.md): code-projects Traffic Offense Reporting System cross-site request forgery (CVSS 5.3, code-projects Traffic Offense Reporting System)
- [CVE-2025-5729](https://cve.now/CVE-2025-5729.md): code-projects Health Center Patient Record Management System birthing\_record.php sql injection (CVSS 5.3, code-projects Health Center Patient Record Management System)
- [CVE-2025-5728](https://cve.now/CVE-2025-5728.md): SourceCodester Open Source Clinic Management System manage\_website.php unrestricted upload (CVSS 5.3, SourceCodester Open Source Clinic Management System)
- [CVE-2025-48908](https://cve.now/CVE-2025-48908.md): Ability Auto Startup service vulnerability in the foundation process Impact: Successful exploitation of this vulnerability may affect availa (CVSS 6.7, Huawei HarmonyOS)
- [CVE-2025-48911](https://cve.now/CVE-2025-48911.md): Vulnerability of improper permission assignment in the note sharing module Impact: Successful exploitation of this vulnerability may affect (CVSS 8.2, Huawei HarmonyOS)
- [CVE-2025-48910](https://cve.now/CVE-2025-48910.md): Buffer overflow vulnerability in the DFile module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2025-48909](https://cve.now/CVE-2025-48909.md): Bypass vulnerability in the device management channel Impact: Successful exploitation of this vulnerability may affect service confidentiali (CVSS 7.1, Huawei HarmonyOS)
- [CVE-2025-5686](https://cve.now/CVE-2025-5686.md): Paged Gallery \<= 0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, andreyk Paged Gallery)
- [CVE-2025-5563](https://cve.now/CVE-2025-5563.md): WP-Addpub \<= 1.2.8 - Authenticated (Contributor+) SQL Injection (CVSS 6.5, cyberscorp WP-Addpub)
- [CVE-2025-5486](https://cve.now/CVE-2025-5486.md): WP Email Debug 1.0 - 1.1.0 - Missing Authorization to Unauthenticated Privilege Escalation via Password Reset (CVSS 9.8, dr\_scythe WP Email Debug)
- [CVE-2025-5541](https://cve.now/CVE-2025-5541.md): Runners Log \<= 3.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, frold Runners Log)
- [CVE-2025-5565](https://cve.now/CVE-2025-5565.md): Hide It \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, jason-lau Hide It)
- [CVE-2025-2935](https://cve.now/CVE-2025-2935.md): Anti-Spam: Spam Protection | Block Spam Users, Comments, Forms \<= 2024.7 - Cross-Site Request Forgery to Multiple Administrative Actions (CVSS 5.4, webguyio Stop Spammers Classic)
- [CVE-2025-5538](https://cve.now/CVE-2025-5538.md): BNS Featured Category \<= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, cais BNS Featured Category)
- [CVE-2025-4964](https://cve.now/CVE-2025-4964.md): WP Online Users Stats \<= 1.0.0 - Authenticated (Editor+) SQL Injection via table\_name Parameter (CVSS 4.9, hk1993 WP Online Users Stats)
- [CVE-2025-4966](https://cve.now/CVE-2025-4966.md): WP Online Users Stats \<= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via hk\_dataset\_results Function (CVSS 6.1, hk1993 WP Online Users Stats)
- [CVE-2025-5018](https://cve.now/CVE-2025-5018.md): Hive Support \<= 1.2.5 - Authenticated (Subscriber+) Missing Authorization via hs\_update\_ai\_chat\_settings and hive\_lite\_support\_get\_all\_binbox (CVSS 7.1, hivesupport Hive Support | AI-Powered Help Desk, Live Chat…)
- [CVE-2025-5536](https://cve.now/CVE-2025-5536.md): Freemind Viewer \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, rsemeteys Freemind Viewer)
- [CVE-2025-5703](https://cve.now/CVE-2025-5703.md): StageShow \<= 10.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via anchor Parameter (CVSS 6.4, malcolm-oph StageShow)
- [CVE-2025-5699](https://cve.now/CVE-2025-5699.md): Developer Formatter \<= 2015.0.2.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom CSS (CVSS 5.5, gsaraiva Developer Formatter)
- [CVE-2025-5586](https://cve.now/CVE-2025-5586.md): WordPress Ajax Load More and Infinite Scroll \<= 1.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter (CVSS 6.4, tushargohel WordPress Ajax Load More and Infinite Scroll)
- [CVE-2025-5019](https://cve.now/CVE-2025-5019.md): Hive Support \<= 1.2.5 - Cross-Site Request Forgery via hs\_update\_ai\_chat\_settings Function (CVSS 5.4, hivesupport Hive Support | AI-Powered Help Desk, Live Chat…)
- [CVE-2025-5534](https://cve.now/CVE-2025-5534.md): ESV Bible Shortcode for WordPress \<= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, calebzahnd ESV Bible Shortcode for WordPress)
- [CVE-2025-5533](https://cve.now/CVE-2025-5533.md): Knowledge Base \<= 2.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, ajay Knowledge Base)
- [CVE-2024-58114](https://cve.now/CVE-2024-58114.md): Resource allocation control failure vulnerability in the ArkUI framework Impact: Successful exploitation of this vulnerability may affect av (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2025-48907](https://cve.now/CVE-2025-48907.md): Deserialization vulnerability in the IPC module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2025-48906](https://cve.now/CVE-2025-48906.md): Authentication bypass vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 8.8, Huawei HarmonyOS)
- [CVE-2025-48905](https://cve.now/CVE-2025-48905.md): Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may cause the failure to (CVSS 8.1, Huawei HarmonyOS)
- [CVE-2025-48904](https://cve.now/CVE-2025-48904.md): Vulnerability that cards can call unauthorized APIs in the FRS process Impact: Successful exploitation of this vulnerability may affect avai (CVSS 4.4, Huawei HarmonyOS)
- [CVE-2025-48903](https://cve.now/CVE-2025-48903.md): Permission bypass vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect availability. (CVSS 7.8, Huawei HarmonyOS)
- [CVE-2025-48902](https://cve.now/CVE-2025-48902.md): Vulnerability of uncontrolled system resource applications in the setting module Impact: Successful exploitation of this vulnerability may a (CVSS 6.6, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2025-5727](https://cve.now/CVE-2025-5727.md): SourceCodester Student Result Management System Announcement Page announcement cross site scripting (CVSS 4.8, SourceCodester Student Result Management System)
- [CVE-2025-5726](https://cve.now/CVE-2025-5726.md): SourceCodester Student Result Management System Division System Page division-system cross site scripting (CVSS 4.8, SourceCodester Student Result Management System)
- [CVE-2023-2921](https://cve.now/CVE-2023-2921.md): Short URL \<= 1.6.8 - Subscriber+ SQLi (CVSS 8.8, Short URL)
- [CVE-2025-5725](https://cve.now/CVE-2025-5725.md): SourceCodester Student Result Management System Grading System Page grading-system cross site scripting (CVSS 4.8, SourceCodester Student Result Management System)
- [CVE-2025-5724](https://cve.now/CVE-2025-5724.md): SourceCodester Student Result Management System Subjects Page subjects cross site scripting (CVSS 4.8, SourceCodester Student Result Management System)
- [CVE-2025-1777](https://cve.now/CVE-2025-1777.md): BM Content Builder \<= 3.16.2.1 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via ux\_cb\_page\_options\_save (CVSS 6.4, SeaTheme BM Content Builder)
- [CVE-2025-1778](https://cve.now/CVE-2025-1778.md): Art Theme \<= 3.12.2.3 - Missing Authorization to Authenticated (Subscriber+) Theme Option Delete (CVSS 4.3, SeaTheme Art Theme)
- [CVE-2025-5723](https://cve.now/CVE-2025-5723.md): SourceCodester Student Result Management System Classes Page classes cross site scripting (CVSS 4.8, SourceCodester Student Result Management System)
- [CVE-2025-5722](https://cve.now/CVE-2025-5722.md): SourceCodester Student Result Management System Add Academic Term terms cross site scripting (CVSS 4.8, SourceCodester Student Result Management System)
- [CVE-2025-36513](https://cve.now/CVE-2025-36513.md): Cross-site request forgery vulnerability exists in surveillance cameras provided by i-PRO Co., Ltd.. (CVSS 4.3, Surveillance cameras provided by i-PRO Co., Ltd.)
- [CVE-2025-5721](https://cve.now/CVE-2025-5721.md): SourceCodester Student Result Management System Profile Setting Page update\_profile cross site scripting (CVSS 4.8, SourceCodester Student Result Management System)
- [CVE-2025-5733](https://cve.now/CVE-2025-5733.md): Modern Events Calendar \<= 7.21.9 - Information Exposure (CVSS 5.3, webnus/ Modern Events Calendar Lite)
- [CVE-2025-5719](https://cve.now/CVE-2025-5719.md): The wallet has an authentication bypass vulnerability that allows access to specific pages. (CVSS 5.1, vivo Wallet)
- [CVE-2025-5716](https://cve.now/CVE-2025-5716.md): SourceCodester Open Source Clinic Management System login.php sql injection (CVSS 6.9, SourceCodester Open Source Clinic Management System)
- [CVE-2024-46941](https://cve.now/CVE-2024-46941.md): SystemUI component protection settings vulnerability (CVSS 4.8, vivo SystemUI)
- [CVE-2025-5715](https://cve.now/CVE-2025-5715.md): Signal App Biometric Authentication missing critical step in authentication (CVSS 1.0, Signal App)
- [CVE-2025-5714](https://cve.now/CVE-2025-5714.md): SoluçõesCoop iSoluçõesWEB Profile Information Update up.upload.php path traversal (CVSS 5.3, SoluçõesCoop iSoluçõesWEB)
- [CVE-2025-5713](https://cve.now/CVE-2025-5713.md): SoluçõesCoop iSoluçõesWEB Flow fluxos-dashboard cross site scripting (CVSS 5.1, SoluçõesCoop iSoluçõesWEB)
- [CVE-2025-5712](https://cve.now/CVE-2025-5712.md): SourceCodester Open Source Clinic Management System appointment.php sql injection (CVSS 6.9, SourceCodester Open Source Clinic Management System)
- [CVE-2025-5711](https://cve.now/CVE-2025-5711.md): code-projects Real Estate Property Management System InsertCity.php sql injection (CVSS 6.9, code-projects Real Estate Property Management System)
- [CVE-2025-5710](https://cve.now/CVE-2025-5710.md): code-projects Real Estate Property Management System InsertState.php sql injection (CVSS 6.9, code-projects Real Estate Property Management System)
- [CVE-2025-5709](https://cve.now/CVE-2025-5709.md): code-projects Real Estate Property Management System InsertCategory.php sql injection (CVSS 6.9, code-projects Real Estate Property Management System)
- [CVE-2024-56343](https://cve.now/CVE-2024-56343.md): IBM Verify Identity Access Digital Credentials denial of service (CVSS 4.3, IBM Verify Identity Access Digital Credentials)
- [CVE-2024-56342](https://cve.now/CVE-2024-56342.md): IBM Verify Identity Access Digital Credentials information disclosure (CVSS 4.3, IBM Verify Identity Access Digital Credentials)
- [CVE-2024-22330](https://cve.now/CVE-2024-22330.md): IBM Security Verify Governance information disclosure (CVSS 5.9, IBM Security Verify Governance)
- [CVE-2025-5708](https://cve.now/CVE-2025-5708.md): code-projects Real Estate Property Management System NewsReport.php sql injection (CVSS 6.9, code-projects Real Estate Property Management System)
- [CVE-2025-5707](https://cve.now/CVE-2025-5707.md): PHPGurukul Human Metapneumovirus Testing Management System registered-user-testing.php sql injection (CVSS 6.9, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-5706](https://cve.now/CVE-2025-5706.md): PHPGurukul Human Metapneumovirus Testing Management System new-user-testing.php sql injection (CVSS 6.9, PHPGurukul Human Metapneumovirus Testing Management System)
- [CVE-2025-49599](https://cve.now/CVE-2025-49599.md): Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow t (CVSS 4.1, Huawei EG8141A5 · Huawei EG8145V5 +1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.