CVEs published July 16, 2025
188 CVEs were published on July 16, 2025: 23 critical, 70 high. 1 is now in CISA KEV.
- Published
- 188
- Critical
- 23
- High
- 70
- Medium
- 91
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 35
Most affected products
- LabRedesCefetRJ WeGIA
- 10
- Digisol XPON ONU Wi-Fi Router
- 5
- Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…
- 5
- emlog
- 4
- Alcatel-Lucent OmniAccess Stellar Products
- 3
- Cisco Identity Services Engine Software
- 3
- Hewlett Packard Enterprise HPE AutoPass License Server
- 3
- Md Yeasin Ul Haider URL Shortener
- 3
- Merit LILIN DVR Firmware
- 3
- Adobe Experience Manager
- 2
Critical 23
- CVE-2025-34132LILIN DVR Command Injection via NTPUpdate in dvr_boxMerit LILIN DVR Firmware
- CVE-2025-34127Achat v0.150 SEH Buffer Overflow via UDPAchat Software Achat Chat Server
- CVE-2025-34125D-Link DSP-W110A1 Cookie Command InjectionD-Link DSP-W110A1
- CVE-2025-34121Idera Up.Time ≤ 7.2 post2file.php Arbitrary File Upload RCEIdera Up.Time Monitoring Station
- CVE-2025-34117Netcore / Netis Routers RCE via UDP Port 53413 BackdoorNetcore Technology Router firmware · Netis Router firmware
- CVE-2025-20337Cisco ISE API Unauthenticated Remote Code Execution VulnerabilityCisco Identity Services Engine Software · Cisco ISE Passive…
- CVE-2025-53937WeGIA has SQL Injection (Blind Time-Based) Vulnerability in `cargo` Parameter on `control.php` EndpointLabRedesCefetRJ WeGIA
- CVE-2025-34300Sawtooth Software Lighthouse Studio < 9.16.14 Pre-Authentication RCESawtooth Software Lighthouse Studio
- CVE-2025-24759WordPress WP-BusinessDirectory <= 3.1.5 - SQL Injection vulnerabilityCMSJunkie - WordPress Business Directory Plugins WP-Busines…
- CVE-2025-28959WordPress URL Shortener <= 3.0.7 - SQL Injection VulnerabilityMd Yeasin Ul Haider URL Shortener
- CVE-2025-28961WordPress URL Shortener <= 3.0.7 - PHP Object Injection VulnerabilityMd Yeasin Ul Haider URL Shortener
- CVE-2025-28982WordPress WP Pipes plugin <= 1.4.3 - SQL Injection VulnerabilityThimPress WP Pipes
- CVE-2025-29009WordPress Medical Prescription Attachment Plugin for WooCommerce <= 1.2.3 - Arbitrary File Upload VulnerabilityWebkul Medical Prescription Attachment Plugin for WooCommer…
- CVE-2025-30936WordPress Torod plugin <= 2.1 - SQL Injection vulnerabilityTorod Company for Information Technology Torod
- CVE-2025-30949WordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection VulnerabilityGuru Team Site Chat on Telegram
- CVE-2025-30973WordPress CoSchool LMS plugin <= 1.4.3 - PHP Object Injection VulnerabilityCodexpert CoSchool LMS
- CVE-2025-48300WordPress Groundhogg plugin <= 4.2.1 - Arbitrary File Upload vulnerabilityAdrian Tobey Groundhogg
- CVE-2025-52714WordPress Traveler theme < 3.2.2 - SQL Injection Vulnerabilityshinetheme Traveler
- CVE-2025-52836WordPress The E-Commerce ERP <= 2.1.1.3 - Privilege Escalation VulnerabilityUnity Business Technology Pty The E-Commerce ERP
- CVE-2025-54010WordPress FluentSnippets plugin <= 10.50 - Cross Site Request Forgery (CSRF) VulnerabilityShahjahan Jewel FluentSnippets
- CVE-2025-7673A buffer overflow vulnerability in the URL parser of the zhttpd web server in Zyxel VMG8825-T50K firmware versions prior to V5.50(ABOM.5)C0 Zyxel VMG8825-T50K firmware
- CVE-2025-52689Weak Session ID Check in the OmniAccess Stellar Web Management InterfaceAlcatel-Lucent OmniAccess Stellar Products
- CVE-2025-52688Command Injection Vulnerability in the OmniAccess Stellar Web Management InterfaceAlcatel-Lucent OmniAccess Stellar Products
High 70
- CVE-2025-34130LILIN DVR Arbitrary File Read via net_html.cgiMerit LILIN DVR Firmware
- CVE-2025-34129LILIN DVR RCE via Malicious FTP/NTP ConfigurationMerit LILIN DVR Firmware
- CVE-2025-34128X360 VideoPlayer ActiveX Control Buffer Overflow via ConvertFile()X360Soft X360 VideoPlayer ActiveX Control
- CVE-2025-34126RIPS Scanner v0.54 Path TraversalRIPS Technologies RIPS Scanner
- CVE-2025-34124Heroes of Might and Magic III .h3m Map File Buffer OverflowThe 3DO Company Heroes of Might and Magic III
- CVE-2025-34123VideoCharge Studio 2.12.3.685 SEH Buffer Overflow via .VSC FileVideoCharge Software Studio
- CVE-2025-34120LimeSurvey 2.0+ - 2.06+ Unauthenticated Arbitrary File Download via Serialized Backup PayloadLimeSurvey
- CVE-2025-34119EasyCafe Server 2.2.14 Remote File Disclosure via Opcode 0x43Tinasoft EasyCafe Server
- CVE-2025-34118Linknat VOS Manager Path Traversal File DisclosureLinknat Technology VOS Manager
- CVE-2025-53908RomM vulnerable to Authenticated Path Traversalrommapp romm
- CVE-2025-37107An authentication bypass vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.Hewlett Packard Enterprise HPE AutoPass License Server
- CVE-2025-37106An authentication bypass and disclosure of information vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.Hewlett Packard Enterprise HPE AutoPass License Server
- CVE-2025-36097IBM WebSphere Application Server denial of serviceIBM WebSphere Application Server
- CVE-2025-37105An hsqldb-related remote code execution vulnerability exists in HPE AutoPass License Server (APLS) prior to 9.18.Hewlett Packard Enterprise HPE AutoPass License Server
- CVE-2025-40777A possible assertion failure when 'stale-answer-client-timeout' is set to '0'ISC BIND
- CVE-2025-53943VoidBot Open-Source Has Improper Permission Check That Allows Unauthorized Command ExecutionDeath1Clown VoidBot_open-source
- CVE-2025-7357Plaintext Storage of a Password in LITEON IC48A and IC80A EV ChargersLITEON IC48A EV Charger · LITEON IC80A EV Charger
- CVE-2025-5994Cache poisoning via the ECS-enabled Rebirthday AttackNLnet Labs Unbound
- CVE-2025-37104HPE Telco Service Orchestrator Software, Authenticated SQL InjectionHewlett Packard Enterprise (HPE) HPE Telco Service Orchestr…
- CVE-2025-53923Emlog vulnerable to reflected Cross-site Scripting in admin panelemlog
- CVE-2025-40776Birthday Attack against Resolvers supporting ECSISC BIND
- CVE-2025-40923Plack-Middleware-Session before version 0.35 for Perl generates session ids insecurelyMIYAGAWA Plack::Middleware::Session
- CVE-2025-24777WordPress Hillter theme <= 3.0.7 - PHP Object Injection Vulnerabilityawethemes Hillter
- CVE-2025-24779WordPress Yogi theme < 2.9.3 - PHP Object Injection VulnerabilityNooTheme Yogi
- CVE-2025-28955WordPress Easy Video Player Wordpress & WooCommerce plugin <= 10.0 - Arbitrary File Download VulnerabilityFWDesign Easy Video Player Wordpress & WooCommerce
- CVE-2025-28965WordPress URL Shortener <= 3.0.7 - Broken Access Control VulnerabilityMd Yeasin Ul Haider URL Shortener
- CVE-2025-29000WordPress Multi-language Responsive Contact Form plugin <= 2.8 - Broken Access Control VulnerabilityAugust Infotech Multi-language Responsive Contact Form
- CVE-2025-30955WordPress ListingEasy theme <= 1.9.2 - Reflected Cross Site Scripting (XSS) vulnerabilityGT3themes ListingEasy
- CVE-2025-31055WordPress Electrician - Electrical Service WordPress theme <= 1.0 - Cross Site Scripting (XSS) Vulnerabilityvergatheme Electrician - Electrical Service WordPress
- CVE-2025-31070WordPress HTML5 Radio Player - WPBakery Page Builder Addon plugin <= 2.5 - Arbitrary File Download vulnerabilityLambertGroup HTML5 Radio Player - WPBakery Page Builder Add…
- CVE-2025-31072WordPress Ofiz - Business Consulting Theme plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerabilitydesignthemes Ofiz - WordPress Business Consulting Theme
- CVE-2025-31422WordPress Visual Art | Gallery WordPress Theme <= 2.4 - PHP Object Injection Vulnerabilitydesignthemes Visual Art | Gallery WordPress Theme
- CVE-2025-31427WordPress Invico - WordPress Consulting Business Theme <= 1.9 - Cross Site Scripting (XSS) Vulnerabilitydesignthemes Invico - WordPress Consulting Business Theme
- CVE-2025-32574WordPress WPGYM plugin <= 65.0 - SQL Injection vulnerabilitymojoomla WPGYM
- CVE-2025-46500WordPress Wordpress Auto Spinner plugin <= 3.26.0 - Reflected Cross Site Scripting (XSS) vulnerabilityValvePress Wordpress Auto Spinner
- CVE-2025-47554WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Reflected Cross Site Scripting (XSS) vulnerabilityQuanticaLabs CSS3 Compare Pricing Tables for WordPress
- CVE-2025-47645WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.4.9 - Subscriber+ SQL Injection vulnerabilityELEXtensions ELEX WooCommerce Advanced Bulk Edit Products,…
- CVE-2025-47652WordPress Infility Global plugin <= 2.13.4 - Reflected Cross Site Scripting (XSS) vulnerabilityInfility Global
- CVE-2025-48291WordPress Contest Gallery <= 26.0.6 - Cross Site Scripting (XSS) VulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2025-48345WordPress Contact Form 7 Editor Button plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerabilityarisoft Contact Form 7 Editor Button
- CVE-2025-49031WordPress SMu Manual DoFollow plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerabilityStefan M. SMu Manual DoFollow
- CVE-2025-49034WordPress Funnel Builder by FunnelKit plugin <= 3.10.2 - SQL Injection vulnerabilityAman Funnel Builder by FunnelKit
- CVE-2025-49876WordPress ProfileGrid plugin <= 5.9.5.2 - SQL Injection vulnerabilityMetagauss ProfileGrid
- CVE-2025-49888WordPress PW WooCommerce On Sale! plugin <= 1.39 - Broken Access Control Vulnerabilitypimwick PW WooCommerce On Sale!
- CVE-2025-52777WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Scripting (XSS) VulnerabilitycmsMinds Pay with Contact Form
- CVE-2025-52779WordPress Dot html,php,xml etc pages plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerabilitykarimmughal Dot html,php,xml etc pages
- CVE-2025-52786WordPress Media Folder plugin <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityKingdom Creation Media Folder
- CVE-2025-52787WordPress Tennis Court Bookings plugin <= 1.2.7 - Cross Site Scripting (XSS) VulnerabilityEZiHosting Tennis Court Bookings
- CVE-2025-52803WordPress Sala theme <= 1.1.3 - Broken Access Control Vulnerabilityuxper Sala
- CVE-2025-52804WordPress Nuss theme <= 1.3.7.1 - Broken Access Control Vulnerabilityuxper Nuss
- CVE-2025-52819WordPress Pakke Envíos plugin <= 1.0.2 - SQL Injection Vulnerabilitypakkemx Pakke Envíos
- CVE-2025-53757Insecure Cookie Flags Vulnerability in Digisol DG-GR6821AC RouterDigisol XPON ONU Wi-Fi Router
- CVE-2025-53756Cleartext Transmission Vulnerability in Digisol DG-GR6821AC RouterDigisol XPON ONU Wi-Fi Router
- CVE-2024-9408In Eclipse GlassFish since version 6.2.5 it is possible to perform a Server Side Request Forgery attack in specific endpoints.Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…
- CVE-2025-48153WordPress Import CDN-Remote Images plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) VulnerabilityAtakan Au Import CDN-Remote Images
- CVE-2025-48161WordPress YaySMTP plugin <= 1.3 - SQL Injection VulnerabilityYayCommerce YaySMTP
- CVE-2025-48299WordPress YayExtra plugin <= 1.5.5 - SQL Injection VulnerabilityYayCommerce YayExtra
- CVE-2025-48301WordPress SMTP for SendGrid – YaySMTP plugin <= 1.5 - SQL Injection VulnerabilityYayCommerce SMTP for SendGrid – YaySMTP
- CVE-2025-54043WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection VulnerabilityYayCommerce SMTP for Amazon SES
- CVE-2025-54026WordPress GymBase Theme Classes plugin <= 1.4 - SQL Injection VulnerabilityQuanticaLabs GymBase Theme Classes
- CVE-2025-53990WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerabilityjetmonsters JetFormBuilder
- CVE-2025-7699An improper access control vulnerability was found in the EZ Sync Manager of ADMASUSTOR ADM
- CVE-2025-40985SQL Injection in SCATI Vision WebSCATI Vision Web
- CVE-2025-6993Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Functionrustaurius Ultimate WP Mail
- CVE-2025-6043Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal <= 17.0 - Authenticated (Subscriber+) Arbitrary File DeletionMalcure Malware Shield — Removal, Repair, Monitor
- CVE-2025-7359Counter live visitors for WooCommerce <= 1.3.6 - Unauthenticated Arbitrary File Deletion in wcvisitor_get_blockdanielriera Counter live visitors for WooCommerce
- CVE-2025-52690Command Injection Vulnerability in the OmniAccess Stellar over UDP ServiceAlcatel-Lucent OmniAccess Stellar Products
- CVE-2025-2800WP Event Manager <= 3.1.50 - Unauthenticated Stored Cross-Site Scripting via 'organizer_name'wpeventmanager WP Event Manager – Events Calendar, Registra…
- CVE-2025-32353Kaseya Rapid Fire Tools Network Detective 2.0.16.0 has Unencrypted Credentials (for privileged access) stored in the collector.txt configura
- CVE-2025-32874An issue was discovered in Kaseya Rapid Fire Tools Network Detective through 2.0.16.0.
Medium, low and unrated 95
- CVE-2025-6983Clickjacking vulnerability on the management web application of TP-LINK Archer C1200TP-Link System Archer C1200
- CVE-2025-6982Hardcoded DES Decryption Keys in TP-Link Archer C50 V3/V4/V5 and C20 V5TP-Link Systems Archer C50 · TP-Link Systems Archer C20
- CVE-2025-53904The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerabilitythe-scratch-channel.github.io
- CVE-2025-20285Cisco Identity Services Engine IP Filter Access Restriction for Admin Access Configuration Bypass VulnerabilityCisco Identity Services Engine Software
- CVE-2025-20288Cisco Unified Intelligence Center Server-Side Request Forgery VulnerabilityCisco Unified Contact Center Express · Cisco Unified Intell…
- CVE-2025-20284Cisco Identity Services Engine Authenticated Remote Code Execution VulnerabilityCisco Identity Services Engine Software
- CVE-2025-20283Cisco Identity Services Engine Authenticated Remote Code Execution VulnerabilityCisco Identity Services Engine Software
- CVE-2025-20272Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection VulnerabilityCisco Evolved Programmable Network Manager · Cisco Prime In…
- CVE-2025-20274Cisco Unified Intelligence Center Arbitrary File Upload VulnerabilityCisco Unified Contact Center Express · Cisco Unified Intell…
- CVE-2025-53938WeGIA vulnerable to Authentication Bypass due to Missing Session Validation in multiple endpointsLabRedesCefetRJ WeGIA
- CVE-2025-53936WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `nome_car`LabRedesCefetRJ WeGIA
- CVE-2025-53935WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint `personalizacao_selecao.php` parameter `id`LabRedesCefetRJ WeGIA
- CVE-2025-53934WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'control.php' parameter 'descricao_emergencia'LabRedesCefetRJ WeGIA
- CVE-2025-47053Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-53933WeGIA vulnerable to Stored Cross-Site Scripting via endpoint 'adicionar_enfermidade.php' parameter 'nome'LabRedesCefetRJ WeGIA
- CVE-2025-53932WeGIA vulnerable to Reflected Cross-Site Scripting via endpoint 'cadastro_adotante.php' parameter 'cpf'LabRedesCefetRJ WeGIA
- CVE-2025-46959Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-53931WeGIA vulnerable to Stored Cross-Site Scripting via endpoint `adicionar_raca.php` parameter `raca`LabRedesCefetRJ WeGIA
- CVE-2025-53930WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint 'adicionar_especie.php' parameter 'especie'LabRedesCefetRJ WeGIA
- CVE-2025-53929WeGIA vulnerable to Stored Cross-Site Scripting (XSS) via endpoint `adicionar_cor.php` parameter `cor`LabRedesCefetRJ WeGIA
- CVE-2025-53926Emlog has Stored Cross-site Scripting vulnerability due to erroremlog
- CVE-2025-53925Emlog has Stored Cross-site Scripting vulnerability in file upload functionalityemlog
- CVE-2025-40913Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflowATRODO Net::Dropbear
- CVE-2025-40919Authen::DigestMD5 versions 0.01 through 0.04 for Perl generate the cnonce insecurelySALVA Authen::DigestMD5
- CVE-2025-3871Broken Access Control Leads to Limited Denial of Service in GoAnywhere MFT 7.8.0 and earlierFortra GoAnywhere MFT
- CVE-2025-40918Authen::SASL::Perl::DIGEST_MD5 versions 2.04 through 2.1800 for Perl generates the cnonce insecurelyEHUELS Authen::SASL::Perl::DIGEST_MD5
- CVE-2025-53924Emlog vulnerable to stored Cross-site Scripting in links functionalityemlog
- CVE-2025-53892Intlify Vue I18n's escapeParameterHtml does not prevent DOM-based XSS via tag attributes like onerrorintlify vue-i18n · vue-i18n +4
- CVE-2025-53840Icinga DB Web Exposure of Sensitive Information to an Unauthorized Actor vulnerabilityicingadb-web
- CVE-2025-53758Default Credential Vulnerability in Digisol DG-GR6821AC RouterDigisol XPON ONU Wi-Fi Router
- CVE-2025-30959WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control VulnerabilityWPFactory Product XML Feed Manager for WooCommerce
- CVE-2025-48339WordPress Profiler - What Slowing Down Your WP <= 1.0.0 - Broken Access Control Vulnerabilityactivity-log.com Profiler - What Slowing Down Your WP
- CVE-2025-49319WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control VulnerabilityWPFactory Wishlist for WooCommerce
- CVE-2025-49884WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerabilityalexvtn Internal Linking of Related Contents
- CVE-2025-50028WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control VulnerabilityCodeSolz Ultimate Push Notifications
- CVE-2025-53755Cleartext Storage Vulnerability in Digisol DG-GR6821AC RouterDigisol XPON ONU Wi-Fi Router
- CVE-2025-53754Hard-coded Credentials Vulnerability in Digisol DG-GR6821AC RouterDigisol XPON ONU Wi-Fi Router
- CVE-2024-10032In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…
- CVE-2024-10031In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the unEclipse Foundation Eclipse Glassfish · org.glassfish.main.a…
- CVE-2024-10029In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.Eclipse Foundation Eclipse Glassfish · org.glassfish.mai… +1
- CVE-2024-9343In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.Eclipse Foundation Eclipse Glassfish · org.glassfish.main.a…
- CVE-2025-48150WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin <= 4.48 - Broken Access Control Vulnerabilitysminozzi Real Estate Property 2024 Create Your Own Fields a…
- CVE-2025-48155WordPress Residential Address Detection plugin <= 2.5.9 - Broken Access Control Vulnerabilityenituretechnology Residential Address Detection
- CVE-2025-48156WordPress Image Wall plugin <= 3.1 - Cross Site Scripting (XSS) VulnerabilityParakoos Image Wall
- CVE-2025-48166WordPress Stop and Block bots plugin Anti bots <= 1.48 - Broken Access Control Vulnerabilitysminozzi Stop and Block bots plugin Anti bots
- CVE-2025-48167WordPress Chatbox Manager plugin <= 1.2.5 - Broken Access Control Vulnerabilityalexvtn Chatbox Manager
- CVE-2025-48294WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) VulnerabilityKerfred FG Drupal to WordPress
- CVE-2025-48295WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerabilityhashthemes Easy Elementor Addons
- CVE-2025-54051WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) VulnerabilitybPlugins LightBox Block
- CVE-2025-54050WordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) VulnerabilityCyberChimps Responsive Addons for Elementor
- CVE-2025-54047WordPress Cost Calculator plugin <= 7.4 - Broken Access Control VulnerabilityQuanticaLabs Cost Calculator
- CVE-2025-54042WordPress WP Post Hide plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) VulnerabilityXfinitysoft WP Post Hide
- CVE-2025-54041WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) VulnerabilityWP Swings Wallet System for WooCommerce
- CVE-2025-54039WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) VulnerabilityToast Plugins Animator
- CVE-2025-54038WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerabilityjetmonsters Restaurant Menu by MotoPress
- CVE-2025-54037WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerabilityblazethemes News Kit Elementor Addons
- CVE-2025-54036WordPress Webba Booking plugin <= 5.1.20 - Cross Site Request Forgery (CSRF) VulnerabilityWebba Appointment Booking Webba Booking
- CVE-2025-54035WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) VulnerabilityTribulant Software Newsletters
- CVE-2025-54033WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) VulnerabilityBlocksWP Theme Builder For Elementor
- CVE-2025-54030WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) VulnerabilityWesternDeal WooCommerce Google Sheet Connector
- CVE-2025-54024WordPress WPAdverts plugin <= 2.2.5 - Cross Site Scripting (XSS) VulnerabilityGreg Winiarski WPAdverts
- CVE-2025-54023WordPress WP Delicious plugin <= 1.8.4 - Cross Site Scripting (XSS) VulnerabilityWP Delicious
- CVE-2025-54022WordPress Coupon Affiliates plugin <= 6.4.0 - Cross Site Request Forgery (CSRF) VulnerabilityElliot Sowersby / RelyWP Coupon Affiliates
- CVE-2025-54020WordPress AntiSpam for Contact Form 7 plugin <= 0.6.3 - Cross Site Request Forgery (CSRF) VulnerabilityErik AntiSpam for Contact Form
- CVE-2025-54018WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control VulnerabilityCreativeMindsSolutions CM Pop-Up banners
- CVE-2025-54016WordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) VulnerabilityKyle Gilman Videopack
- CVE-2025-54015WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion VulnerabilityHT Plugins HT Contact Form
- CVE-2025-54013WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerabilityinfo@welcart Welcart e-Commerce
- CVE-2025-54011WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control VulnerabilitySMTP2GO
- CVE-2025-54009WordPress JetSmartFilters plugin <= 3.6.8 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetSmartFilters
- CVE-2025-54006WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerabilityboldthemes Bold Page Builder
- CVE-2025-53997WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerabilityfavethemes Houzez
- CVE-2025-53996WordPress JetSearch plugin <= 3.5.10.1 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetSearch
- CVE-2025-53995WordPress JetPopup plugin <= 2.0.15.1 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetPopup
- CVE-2025-53994WordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetPopup
- CVE-2025-53991WordPress JetTricks plugin <= 1.5.4.1 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetTricks
- CVE-2025-53989WordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetBlocks For Elementor
- CVE-2025-53986WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerabilitythemeisle Hestia
- CVE-2025-53984WordPress JetTabs plugin <= 2.2.9 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetTabs
- CVE-2025-53982WordPress JetElements For Elementor plugin <= 2.7.7 - Cross Site Scripting (XSS) VulnerabilityCrocoblock JetElements For Elementor
- CVE-2024-9342In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of faEclipse Foundation Eclipse Glassfish · org.glassfish.main.a…
- CVE-2025-22227CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP ClientVMware Reactor Netty · io.projectreactor.netty:reactor-nett…
- CVE-2025-40724Stored Cross-Site Scripting (XSS) in Pharmacy POS PHP ScriptPharmacy POS PHP Script
- CVE-2025-7035Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodesdglingren Media Library Assistant
- CVE-2025-5284Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinglitonice13 Master Addons For Elementor – Widgets, Extension…
- CVE-2025-7703Authentication vulnerability in the mobile application（tech.palm.id）may lead to the risk of information leakage.TECNO tech.palm.id
- CVE-2025-27465x86: Incorrect stubs exception handling for flags recoveryXen
- CVE-2025-6747Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemefusion Avada (Fusion) Builder
- CVE-2025-5845Affiliate Reviews <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameterwpchop Affiliate Reviews
- CVE-2025-5843Brandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id ParameterBrandfolder – Digital Asset Management Simplified.
- CVE-2025-52687JavaScript Injection Vulnerability in the OmniAccess Stellar Web Management InterfaceAlcatel-Lucent OmniAccess Stellar
- CVE-2025-2799WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scriptingwpeventmanager WP Event Manager – Events Calendar, Registra…
- CVE-2025-53842Use of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN firmware all versions.ZEXELON CO. ZWX-2000CSW2-HN · ZEXELON CO. ZWX-2000CS2-HN
- CVE-2025-6977ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' functionmetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2024-42912A cross-site scripting (XSS) vulnerability in META-INF Kft.