CVEs published September 22, 2025
414 CVEs were published on September 22, 2025: 10 critical, 60 high.
- Published
- 414
- Critical
- 10
- High
- 60
- Medium
- 340
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 39
Most affected products
- Campcodes Online Learning Management System
- 7
- code-projects Hostel Management System
- 7
- Campcodes Online Beauty Parlor Management System
- 4
- cubecart
- 4
- fuyang_lipengjun platform
- 4
- Artifex Ghostscript
- 3
- code-projects Online Bidding System
- 3
- Liferay Portal · Liferay DXP +1
- 3
- activewebsight SEO Backlink Monitor
- 2
- Airship AI Acropolis
- 2
Critical 10
- CVE-2025-59528Flowise has Remote Code Execution vulnerabilityFlowiseAI Flowise · flowise
- CVE-2025-59434Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript FunctionFlowiseAI Flowise
- CVE-2025-58255WordPress Custom Post Type Images Plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerabilityyonisink Custom Post Type Images
- CVE-2025-35042Airship AI Acropolis default credentialsAirship AI Acropolis
- CVE-2025-56074A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management Syste
- CVE-2025-57432Blackmagic Web Presenter version 3.3 exposes a Telnet service on port 9977 that accepts unauthenticated commands.
- CVE-2025-57437The Blackmagic Web Presenter HD firmware version 3.3 exposes sensitive information via an unauthenticated Telnet service on port 9977.
- CVE-2025-57441The Blackmagic ATEM Mini Pro 2.7 exposes sensitive device and stream configuration information via an unauthenticated Telnet service on port
- CVE-2025-57601AiKaan Cloud Controller uses a single hardcoded SSH private key and the username `proxyuser` for remote terminal access to all managed IoT/e
- CVE-2025-57602Insufficient hardening of the proxyuser account in the AiKaan IoT management platform, combined with the use of a shared, hardcoded SSH priv
High 60
- CVE-2025-10815Tenda AC20 HTTP POST Request SetPptpServerCfg strcpy buffer overflowTenda AC20
- CVE-2025-59532Codex has sandbox bypass due to bug in path configuration logicopenai codex · @openai/codex
- CVE-2025-59527FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerabilityFlowiseAI Flowise · flowise
- CVE-2025-8892PRT File Parsing Memory Corruption VulnerabilityAutodesk Shared Components
- CVE-2025-59430Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLinkFrontFin mesh-web-sdk · @meshconnect/web-link-sdk
- CVE-2025-58956WordPress WP Attractive Donations System Plugin < 1.29 - Cross Site Request Forgery (CSRF) Vulnerabilityloopus WP Attractive Donations System
- CVE-2025-58973WordPress Easy Elementor Addons Plugin <= 2.2.8 - Local File Inclusion Vulnerabilityhashthemes Easy Elementor Addons
- CVE-2025-59570WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection VulnerabilityWPFunnels Mail Mint
- CVE-2025-59572WordPress WorkScout-Core Plugin < 1.7.06 - Cross Site Request Forgery (CSRF) Vulnerabilitypurethemes WorkScout-Core
- CVE-2025-59588WordPress Soledad Theme <= 8.6.8 - Local File Inclusion VulnerabilityPenciDesign Soledad
- CVE-2025-53450WordPress Easy Pricing Table WP Plugin <= 1.1.3 - Local File Inclusion VulnerabilityPluginwale Easy Pricing Table WP
- CVE-2025-53465WordPress GSheets Connector Plugin <= 1.1.1 - PHP Object Injection Vulnerabilityraoinfotech GSheets Connector
- CVE-2025-53468WordPress Wp tabber widget Plugin <= 4.0 - SQL Injection Vulnerabilitygopiplus@hotmail.com Wp tabber widget
- CVE-2025-57918WordPress LinkedInclude Plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) VulnerabilityERA404 LinkedInclude
- CVE-2025-57919WordPress ConveyThis plugin <= 269.1 - PHP Object Injection vulnerabilityConveyThis
- CVE-2025-57925WordPress immonex Kickstart Team Plugin <= 1.6.9 - Local File Inclusion Vulnerabilityimmonex Kickstart Team
- CVE-2025-57968WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikRestaurants
- CVE-2025-57977WordPress Flexible PDF Invoices for WooCommerce & WordPress Plugin <= 6.0.13 - Cross Site Request Forgery (CSRF) Vulnerabilitywpdesk Flexible PDF Invoices for WooCommerce & WordPress
- CVE-2025-58013WordPress CouponXxL Theme <= 4.5.0 - Cross Site Request Forgery (CSRF) Vulnerabilitypebas CouponXxL
- CVE-2025-58244WordPress Constructo Theme <= 4.3.9 - Cross Site Request Forgery (CSRF) VulnerabilityAnps Constructo
- CVE-2025-58250WordPress Findgo Theme <= 1.3.55 - Cross Site Request Forgery (CSRF) VulnerabilityApusTheme Findgo
- CVE-2025-58259WordPress Nokri Theme <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerabilityscriptsbundle Nokri
- CVE-2025-58261WordPress Mavis HTTPS to HTTP Redirection Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) VulnerabilityPressPage Entertainment Mavis HTTPS to HTTP Redirection
- CVE-2025-58262WordPress Sweet Energy Efficiency plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityWPDirectoryKit Sweet Energy Efficiency
- CVE-2025-58267WordPress Stock Message Plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) VulnerabilityAftabul Islam Stock Message
- CVE-2025-58268WordPress WPMK PDF Generator Plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) VulnerabilityWPMK PDF Generator
- CVE-2025-58270WordPress NIX Anti-Spam Light Plugin <= 0.0.4 - Cross Site Request Forgery (CSRF) VulnerabilityNIX Solutions NIX Anti-Spam Light
- CVE-2025-58657WordPress Grid plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityEdwardBock Grid
- CVE-2025-58662WordPress Awesome Support plugin <= 6.3.5 - Deserialization of untrusted data vulnerabilityawesomesupport Awesome Support
- CVE-2025-58670WordPress WP Content Protection Plugin <= 1.3 - Cross Site Request Forgery (CSRF) VulnerabilityShankaranand Maurya WP Content Protection
- CVE-2025-58671WordPress Auction Feed plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) vulnerabilitymorganrichards Auction Feed
- CVE-2025-58676WordPress HORIZONTAL SLIDER Plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerabilityextendyourweb HORIZONTAL SLIDER
- CVE-2025-58677WordPress ShrinkTheWeb (STW) Website Previews Plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) Vulnerabilitypuravida1976 ShrinkTheWeb (STW) Website Previews
- CVE-2025-58686WordPress Perfect Brands for WooCommerce plugin <= 3.6.2 - SQL Injection vulnerabilityquadlayers Perfect Brands for WooCommerce
- CVE-2025-58687WordPress Current Age Plugin Plugin <= 1.6 - Cross Site Request Forgery (CSRF) VulnerabilityWP CMS Ninja Current Age Plugin
- CVE-2025-58688WordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) VulnerabilityCasengo Live Chat Support
- CVE-2025-58690WordPress Doliconnect Plugin <= 9.5.7 - Cross Site Request Forgery (CSRF) Vulnerabilityptibogxiv Doliconnect
- CVE-2025-59420Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)authlib
- CVE-2025-59335CubeCart Session Not Invalidated After Password Changecubecart
- CVE-2025-35041Airship AI Acropolis MFA insufficient rate limitingAirship AI Acropolis
- CVE-2025-36202IBM webMethods Integration code executionIBM webMethods Integration
- CVE-2025-10803Tenda AC23 HTTP POST Request SetPptpServerCfg sscanf buffer overflowTenda AC23
- CVE-2025-9038S1 Agile Privilege EscalationGE Vernova S1 Agile Configuration Software
- CVE-2025-10854Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indicestxtai
- CVE-2025-9983Lack of Authentication for RTSP streamGALAYOU G2
- CVE-2025-10792D-Link DIR-513 formWPS buffer overflowD-Link DIR-513
- CVE-2025-10009Authenticated admin RCE in Invoice NinjaInvoice Ninja
- CVE-2025-5962Rhel-lightspeed: improper access control in lightspeed history management allows local privilege manipulationRed Hat Enterprise Linux
- CVE-2025-10779D-Link DCS-935L HNAP1 sub_402280 stack-based overflowD-Link DCS-935L
- CVE-2025-10773B-Link BL-AC2100 Web Management set_delshrpath_cfg delshrpath stack-based overflowB-Link BL-AC2100
- CVE-2025-43953In 2wcom IP-4c 2.16, the web interface allows admin and manager users to execute arbitrary code as root via a ping or traceroute field on th
- CVE-2025-51006Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the dlt_linuxsll2_cleanup() function in plugins/dlt_linuxs
- CVE-2025-55888Cross-Site Scripting (XSS) vulnerability was discovered in the Ajax transaction manager endpoint of ARD.
- CVE-2025-57430Creacast Creabox Manager 4.4.4 exposes sensitive configuration data via a publicly accessible endpoint /get.
- CVE-2025-57431The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution (RCE) via a malicious firmware update
- CVE-2025-57434Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation.
- CVE-2025-57439Creacast Creabox Manager 4.4.4 contains a critical Remote Code Execution vulnerability accessible via the edit.php endpoint.
- CVE-2025-57440The Blackmagic ATEM Mini Pro 2.7 exposes an undocumented Telnet service on TCP port 9993, which accepts unauthenticated plaintext commands f
- CVE-2025-57605Lack of server-side authorisation on department admin assignment APIs in AiKaan IoT Platform allows authenticated users to elevate their pri
- CVE-2025-57685The LB-Link routers, including the BL-AC2100_AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000_AE4 v2.4.9, BL-AC1900_AZ2 v1.0.2, BL-X26_AC8 v1.2.8, an
Medium, low and unrated 344
- CVE-2025-10823axboe fio options.c str_buffer_pattern_cb null pointer dereferenceaxboe fio
- CVE-2025-10822fuyang_lipengjun platform queryAll SysSmsLogController improper authorizationfuyang_lipengjun platform
- CVE-2025-10821fuyang_lipengjun platform queryAll TopicCategoryController improper authorizationfuyang_lipengjun platform
- CVE-2025-43814In Liferay Portal 7.4.0 through 7.4.3.112, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.8, 2023.Q3.1 through 20Liferay Portal · Liferay DXP +1
- CVE-2025-10820fuyang_lipengjun platform queryAll TopicController improper authorizationfuyang_lipengjun platform
- CVE-2025-10819fuyang_lipengjun platform queryAll UserCouponController improper authorizationfuyang_lipengjun platform
- CVE-2025-43810Insecure Direct Object Reference (IDOR) vulnerability with commerce order notes in Liferay Portal 7.3.5 through 7.4.3.112, and Liferay DXP 2Liferay Portal · Liferay DXP +1
- CVE-2025-10817Campcodes Online Learning Management System admin_user.php sql injectionCampcodes Online Learning Management System
- CVE-2025-43806Batch Engine in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Q4.0 through 2023.Q4.7, 2023.Q3.1 through 2023.Q3.10, and 7.4 GLiferay Portal · Liferay DXP +2
- CVE-2025-10816Jinher OA XML text xml external entity referenceJinher OA
- CVE-2025-47910CrossOriginProtection insecure bypass patterns not limited to exact matches in net/httpGo standard library net/http · stdlib
- CVE-2025-59535DotNetNuke.Core allows loading of unused themes on anonymous clients through query parametersdnnsoftware Dnn.Platform · DotNetNuke.Core
- CVE-2025-10814D-Link DIR-823X goahead command injectionD-Link DIR-823X
- CVE-2025-10813code-projects Hostel Management System index.php sql injectioncode-projects Hostel Management System
- CVE-2025-10812code-projects Hostel Management System index.php sql injectioncode-projects Hostel Management System
- CVE-2025-59526Mailgen: HTML injection vulnerability in plaintext e-mailseladnava mailgen · mailgen
- CVE-2025-59432Timing Attack Vulnerability in SCRAM Authenticationongres scram · com.ongres.scram:scram-common
- CVE-2025-59433@conventional-changelog/git-client has an Argument Injection vulnerabilityconventional-changelog · @conventional-changelog/git-client
- CVE-2025-10811code-projects Hostel Management System index.php sql injectioncode-projects Hostel Management System
- CVE-2025-9960is-localhost-ip 2.0.0 - SSRF via Restrictions bypassis-localhost-ip
- CVE-2025-10810Campcodes Online Learning Management System edit_user.php sql injectionCampcodes Online Learning Management System
- CVE-2025-58957WordPress VPSUForm Plugin <= 3.2.20 - Broken Access Control VulnerabilityVikas Ratudi VPSUForm
- CVE-2025-58960WordPress IP Based Login Plugin <= 2.4.3 - Cross Site Scripting (XSS) Vulnerabilitybrijeshk89 IP Based Login
- CVE-2025-58962WordPress Publitio Plugin <= 2.2.1 - Server Side Request Forgery (SSRF) VulnerabilityPublitio
- CVE-2025-58965WordPress Fusion Page Builder : Extension – Gallery Plugin <= 1.7.6 - Cross Site Scripting (XSS) VulnerabilityAgency Dominion Fusion Page Builder : Extension – Gallery
- CVE-2025-58968WordPress MaxiBlocks Plugin <= 2.1.3 - Broken Access Control VulnerabilityChristiaan Pieterse MaxiBlocks
- CVE-2025-58969WordPress Custom Login URL Plugin <= 1.0.2 - Broken Access Control VulnerabilityGreg Winiarski Custom Login URL
- CVE-2025-58974WordPress WPComplete Plugin <= 2.9.5.2 - Cross Site Scripting (XSS) VulnerabilityStellarWP WPComplete
- CVE-2025-58992WordPress Product Catalog Simple Plugin <= 1.8.2 - Cross Site Scripting (XSS) VulnerabilityimpleCode Product Catalog Simple
- CVE-2025-59549WordPress GetResponse Forms Plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerabilityfatcatapps GetResponse Forms
- CVE-2025-59551WordPress Revive.so Plugin <= 2.0.6 - Broken Access Control VulnerabilityWP Chill Revive.so
- CVE-2025-59552WordPress Save as PDF Plugin <= 4.5.2 - Cross Site Scripting (XSS) VulnerabilityPdfcrowd Dev Team Save as PDF
- CVE-2025-59553WordPress Custom iFrame for Elementor Plugin <= 1.0.13 - Cross Site Scripting (XSS) VulnerabilityCoderz Studio Custom iFrame for Elementor
- CVE-2025-59559WordPress Payrexx Payment Gateway for WooCommerce Plugin <= 3.1.5 - Broken Access Control VulnerabilityPayrexx Payment Gateway for WooCommerce
- CVE-2025-59561WordPress Smart Blocks Plugin <= 2.4 - Broken Access Control Vulnerabilityhashthemes Smart Blocks
- CVE-2025-59562WordPress Academy LMS Plugin <= 3.3.4 - Insecure Direct Object References (IDOR) VulnerabilityKodezen Academy LMS
- CVE-2025-59565WordPress Upsell Order Bump Offer for WooCommerce Plugin <= 3.0.7 - Cross Site Scripting (XSS) VulnerabilityWP Swings Upsell Order Bump Offer for WooCommerce
- CVE-2025-59567WordPress Coupon Affiliates Plugin <= 6.8.0 - Broken Access Control VulnerabilityElliot Sowersby / RelyWP Coupon Affiliates
- CVE-2025-59568WordPress Zoho Flow Plugin <= 2.14.1 - Cross Site Request Forgery (CSRF) VulnerabilityZoho Flow
- CVE-2025-59569WordPress CubeWP Plugin <= 1.1.26 - Cross Site Scripting (XSS) VulnerabilityImran Tauqeer CubeWP
- CVE-2025-59573WordPress Cozy Blocks Plugin <= 2.1.29 - Content Injection VulnerabilityCozyThemes Cozy Blocks
- CVE-2025-59574WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) VulnerabilityWP Travel Engine
- CVE-2025-59576WordPress MasterStudy LMS Plugin <= 3.6.20 - Broken Access Control VulnerabilityStylemix MasterStudy LMS
- CVE-2025-59577WordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition VulnerabilityStylemix MasterStudy LMS
- CVE-2025-59581WordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion VulnerabilityVW THEMES Ibtana
- CVE-2025-59582WordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure VulnerabilityDarren Cooney Ajax Load More
- CVE-2025-59583WordPress Penci Filter Everything Plugin < 1.7 - Cross Site Scripting (XSS) VulnerabilityPenciDesign Penci Filter Everything
- CVE-2025-59584WordPress Penci Podcast Plugin <= 1.6 - Cross Site Scripting (XSS) VulnerabilityPenciDesign Penci Podcast
- CVE-2025-59585WordPress Penci Recipe Plugin <= 4.0 - Cross Site Scripting (XSS) VulnerabilityPenciDesign Penci Recipe
- CVE-2025-59586WordPress Penci Portfolio Plugin <= 3.5 - Cross Site Scripting (XSS) VulnerabilityPenciDesign Penci Portfolio
- CVE-2025-59587WordPress Penci Shortcodes & Performance Plugin < 6.1 - Cross Site Scripting (XSS) VulnerabilityPenciDesign Penci Shortcodes & Performance
- CVE-2025-59589WordPress Soledad Theme <= 8.6.8 - Cross Site Scripting (XSS) VulnerabilityPenciDesign Soledad
- CVE-2025-59590WordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) VulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2025-59591WordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control VulnerabilityAdvancedCoding wpDiscuz
- CVE-2025-59592WordPress Make Column Clickable Elementor Plugin <= 1.6.0 - Cross Site Scripting (XSS) VulnerabilityFernando Acosta Make Column Clickable Elementor
- CVE-2025-53452WordPress Event Rocket Plugin <= 3.3 - Broken Access Control VulnerabilityBarry Event Rocket
- CVE-2025-53451WordPress Mihdan: No External Links Plugin <= 5.1.6.2 - Cross Site Request Forgery (CSRF) VulnerabilityMihdan: No External Links
- CVE-2025-53454WordPress Ultimate WP Mail Plugin <= 1.3.8 - Cross Site Scripting (XSS) VulnerabilityRustaurius Ultimate WP Mail
- CVE-2025-53455WordPress CashBill.pl – Płatności WooCommerce Plugin <= 3.2.1 - Cross Site Scripting (XSS) VulnerabilityCashBill.pl – Płatności WooCommerce
- CVE-2025-53456WordPress SEO Backlink Monitor plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerabilityactivewebsight SEO Backlink Monitor
- CVE-2025-53457WordPress SEO Backlink Monitor plugin <= 1.8.0 - Server Side Request Forgery (SSRF) vulnerabilityactivewebsight SEO Backlink Monitor
- CVE-2025-53458WordPress Goracash Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerabilitydavaxi Goracash
- CVE-2025-36064IBM Sterling Connect:Express for Microsoft Windows information disclosureIBM Sterling Connect:Express for Microsoft Windows
- CVE-2025-53460WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) VulnerabilitySyed Balkhi AffiliateWP – External Referral Links
- CVE-2025-53461WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) VulnerabilityBinsaifullah Beaf
- CVE-2025-53462WordPress SAPO Feed plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerabilitySAPO Feed
- CVE-2025-53463WordPress HT Mega – Absolute Addons for WPBakery Page Builder Plugin <= 1.0.9 - Cross Site Scripting (XSS) VulnerabilityHT Plugins HT Mega – Absolute Addons for WPBakery Page Buil…
- CVE-2025-53464WordPress WP Mailto Links Plugin <= 3.1.4 - Cross Site Scripting (XSS) VulnerabilityOnline Optimisation WP Mailto Links
- CVE-2025-53466WordPress Better Find and Replace Plugin <= 1.7.6 - Cross Site Scripting (XSS) VulnerabilityCodeSolz Better Find and Replace
- CVE-2025-53467WordPress Login-Logout Plugin <= 3.8 - Cross Site Scripting (XSS) Vulnerabilitywebvitaly Login-Logout
- CVE-2025-53469WordPress BMI Adult & Kid Calculator Plugin <= 1.2.2 - Cross Site Scripting (XSS) VulnerabilityMortgage Calculator BMI Adult & Kid Calculator
- CVE-2025-53570WordPress DELUCKS SEO Plugin <= 2.7.0 - Cross Site Scripting (XSS) VulnerabilityDELUCKS SEO
- CVE-2025-57898WordPress WP Frontend Admin plugin <= 1.22.7 - Cross Site Scripting (XSS) vulnerabilityJose Vega WP Frontend Admin
- CVE-2025-57899WordPress WP Compress Plugin <= 6.50.54 - Broken Access Control VulnerabilityAresIT WP Compress
- CVE-2025-57900WordPress GutenKit Plugin <= 2.4.2 - Cross Site Scripting (XSS) VulnerabilityAtaur R GutenKit
- CVE-2025-57902WordPress RIS Version Switcher – Downgrade or Upgrade WP Versions Easily Plugin <= 1.0 - Cross Site Request Forgery (CSRF) VulnerabilityMd Taufiqur Rahman RIS
- CVE-2025-57903WordPress WooCommerce Additional Fees On Checkout (Free) plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerabilityWPSuperiors Developer WooCommerce Additional Fees On Checko…
- CVE-2025-57904WordPress Sales Count Manager for WooCommerce plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityWP-EXPERTS.IN Sales Count Manager for WooCommerce
- CVE-2025-57905WordPress AgreeMe Checkboxes For WooCommerce Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) VulnerabilityAmin Y AgreeMe Checkboxes For WooCommerce
- CVE-2025-57906WordPress Epeken All Kurir plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerabilityEpeken All Kurir
- CVE-2025-57907WordPress Heureka Plugin <= 1.1.0 - Broken Access Control VulnerabilityHeureka Group Heureka
- CVE-2025-57908WordPress Product Time Countdown for WooCommerce plugin <= 1.6.5 - Cross Site Scripting (XSS) vulnerabilityProWCPlugins Product Time Countdown for WooCommerce
- CVE-2025-57909WordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerabilityRouergue Création Editor Custom Color Palette
- CVE-2025-57910WordPress AnyClip Luminous Studio Plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityAnyClip Video Platform AnyClip Luminous Studio
- CVE-2025-57911WordPress Adverts Plugin <= 1.4 - Cross Site Scripting (XSS) VulnerabilityWPFactory Adverts
- CVE-2025-57912WordPress Dialogity Free Live Chat plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilityDialogity Free Live Chat
- CVE-2025-57913WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilityeleopard Behance Portfolio Manager
- CVE-2025-57914WordPress Deliver via Shipos for WooCommerce plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerabilityMatat Technologies Deliver via Shipos for WooCommerce
- CVE-2025-57915WordPress TOCHAT.BE Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) VulnerabilityCésar Martín TOCHAT.BE
- CVE-2025-57916WordPress WP System Information Plugin <= 1.5 - Sensitive Data Exposure VulnerabilityNurul Amin WP System Information
- CVE-2025-57917WordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.8 - Broken Access Control vulnerabilityPrintcart Web to Print Product Designer for WooCommerce
- CVE-2025-57920WordPress Category Featured Images Extended Plugin <= 1.52 - Cross Site Scripting (XSS) VulnerabilityCK MacLeod Category Featured Images Extended
- CVE-2025-57921WordPress Frontend File Manager plugin <= 23.3 - Broken Access Control vulnerabilityN-Media Frontend File Manager
- CVE-2025-57922WordPress Envíos Coordinadora Woocommerce plugin <= 1.1.32 - Sensitive Data Exposure vulnerabilityCoordinadora Mercantil S.A. Envíos Coordinadora Woocommerce
- CVE-2025-57923WordPress UK Address Postcode Validation plugin <= 3.9.2 - Sensitive Data Exposure vulnerabilityIdeal Postcodes UK Address Postcode Validation
- CVE-2025-57924WordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) VulnerabilityAutomattic Developer
- CVE-2025-57926WordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) VulnerabilityWP Chill Passster
- CVE-2025-57927WordPress Dashboard Notepad Plugin <= 1.42 - Cross Site Request Forgery (CSRF) VulnerabilityStephanie Leary Dashboard Notepad
- CVE-2025-57928WordPress AWP Classifieds plugin <= 4.4.3 - Content Injection vulnerabilityStrategy11 Team AWP Classifieds
- CVE-2025-57929WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerabilitykanwei_doublethedonation Double the Donation
- CVE-2025-57930WordPress Double the Donation Plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) Vulnerabilitykanwei_doublethedonation Double the Donation
- CVE-2025-57932WordPress PowerFolio Plugin <= 3.2.1 - Cross Site Scripting (XSS) VulnerabilityDiego Pereira PowerFolio
- CVE-2025-57933WordPress Piotnet Forms Plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) Vulnerabilitypiotnetdotcom Piotnet Forms
- CVE-2025-57934WordPress LWS Affiliation Plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) VulnerabilityAurélien LWS LWS Affiliation
- CVE-2025-57935WordPress Bot Block – Stop Spam Referrals in Google Analytics Plugin <= 2.6 - Cross Site Scripting (XSS) VulnerabilityRicky Dawn Bot Block – Stop Spam Referrals in Google Analyt…
- CVE-2025-57936WordPress Subresource Integrity (SRI) Manager Plugin <= 0.4.0 - Broken Access Control VulnerabilityMeitar Subresource Integrity (SRI) Manager
- CVE-2025-57937WordPress WPeMatico RSS Feed Fetcher Plugin <= 2.8.10 - Sensitive Data Exposure Vulnerabilityetruel WPeMatico RSS Feed Fetcher
- CVE-2025-57938WordPress Easy Hotel Booking plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerabilitythemewant Easy Hotel Booking
- CVE-2025-57939WordPress Image Hover Effects – Elementor Addon Plugin <= 1.4.4 - Broken Access Control VulnerabilityBlocksera Image Hover Effects – Elementor Addon
- CVE-2025-57940WordPress Append extensions on Pages Plugin <= 1.1.2 - Cross Site Scripting (XSS) VulnerabilitySuresh Kumar Mukhiya Append extensions on Pages
- CVE-2025-57941WordPress Append Link on Copy Plugin <= 0.2 - Cross Site Scripting (XSS) VulnerabilityJonathanMH Append Link on Copy
- CVE-2025-57942WordPress Emergency Password Reset plugin <= 9.3 - Cross Site Request Forgery (CSRF) vulnerabilityandy_moyle Emergency Password Reset
- CVE-2025-57943WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3.1 - Server Side Request Forgery (SSRF) vulnerabilitySkimlinks Affiliate Marketing Tool
- CVE-2025-57944WordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3 - Broken Access Control vulnerabilitySkimlinks Affiliate Marketing Tool
- CVE-2025-57945WordPress WP Advanced PDF Plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerabilitycedcommerce WP Advanced PDF
- CVE-2025-57946WordPress payOS plugin <= 1.0.73 - Cross Site Request Forgery (CSRF) vulnerabilityLoc Bui payOS
- CVE-2025-57947WordPress Photo Gallery by Ays Plugin <= 6.3.8 - Cross Site Scripting (XSS) VulnerabilityAys Pro Photo Gallery by Ays
- CVE-2025-57948WordPress Directory Pro Plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerabilitye-plugins Directory Pro
- CVE-2025-57949WordPress Ongkoskirim.id Plugin <= 1.0.6 - Broken Access Control Vulnerabilityoggix Ongkoskirim.id
- CVE-2025-57950WordPress Plugin Security Scanner Plugin <= 2.0.2 - Cross Site Scripting (XSS) VulnerabilityGlen Scott Plugin Security Scanner
- CVE-2025-57951WordPress SiteNarrator Text-to-Speech Widget Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerabilityken107 SiteNarrator Text-to-Speech Widget
- CVE-2025-57952WordPress Maps for WP Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerabilityicopydoc Maps for WP
- CVE-2025-57953WordPress Open User Map Plugin <= 1.4.14 - Cross Site Scripting (XSS) Vulnerability100plugins Open User Map
- CVE-2025-57954WordPress Poll Maker Plugin <= 6.0.2 - Cross Site Scripting (XSS) VulnerabilityAys Pro Poll Maker
- CVE-2025-57955WordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control VulnerabilityPlugin Devs Post Carousel Slider for Elementor
- CVE-2025-57956WordPress WooMS Plugin <= 9.12 - Cross Site Scripting (XSS) Vulnerabilitywpcraft WooMS
- CVE-2025-57957WordPress WooMS Plugin <= 9.12 - Broken Access Control Vulnerabilitywpcraft WooMS
- CVE-2025-57959WordPress Slightly troublesome permalink Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerabilitytmatsuur Slightly troublesome permalink
- CVE-2025-57960WordPress Travel Map Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) VulnerabilityTravelMap Travel Map
- CVE-2025-57961WordPress CoDesigner plugin <= 4.29 - Broken Access Control vulnerabilityCodexpert CoDesigner
- CVE-2025-57962WordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerabilitye4jvikwp VikRestaurants
- CVE-2025-57963WordPress Zoho Billing Plugin <= 4.1 - Cross Site Scripting (XSS) VulnerabilityZoho Subscriptions Zoho Billing
- CVE-2025-57964WordPress Library Bookshelves Plugin <= 5.11 - Cross Site Scripting (XSS) Vulnerabilityphotonicgnostic Library Bookshelves
- CVE-2025-57965WordPress WP Proposals Plugin <= 2.3 - Cross Site Scripting (XSS) VulnerabilityWP CodeUs WP Proposals
- CVE-2025-57966WordPress Gallery Lightbox plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Gallery Lightbox
- CVE-2025-57967WordPress WPB Quick View for WooCommerce plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilityWPBean WPB Quick View for WooCommerce
- CVE-2025-57969WordPress Hide WP Toolbar Plugin <= 2.7 - Broken Access Control VulnerabilityJeremy Saxey Hide WP Toolbar
- CVE-2025-57970WordPress SALESmanago Plugin <= 3.8.1 - Cross Site Request Forgery (CSRF) VulnerabilitySALESmanago & Leadoo
- CVE-2025-57971WordPress SALESmanago Plugin <= 3.8.1 - Broken Access Control VulnerabilitySALESmanago & Leadoo
- CVE-2025-57972WordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerabilityWPFactory Helpdesk Support Ticket System for WooCommerce
- CVE-2025-57973WordPress WP-Members Plugin <= 3.5.4.2 - Cross Site Scripting (XSS) VulnerabilityChad Butler WP-Members
- CVE-2025-57974WordPress TZ PlusGallery Plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerabilitytuyennv TZ PlusGallery
- CVE-2025-57975WordPress Team Plugin <= 5.0.6 - Broken Access Control VulnerabilityRadiusTheme Team
- CVE-2025-57976WordPress CardCom Payment Gateway plugin <= 3.5.0.7 - Broken Access Control vulnerabilityCardCom Payment Gateway
- CVE-2025-57978WordPress Advanced Appointment Booking & Scheduling plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerabilitythemespride Advanced Appointment Booking & Scheduling
- CVE-2025-57979WordPress AuthorSure Plugin <= 2.3 - Cross Site Scripting (XSS) VulnerabilityRussell Jamieson AuthorSure
- CVE-2025-57980WordPress Safety Exit Plugin <= 1.8.0 - Cross Site Scripting (XSS) VulnerabilityTomas Cordero Safety Exit
- CVE-2025-57981WordPress WP Social Widget Plugin <= 2.3.1 - Cross Site Scripting (XSS) Vulnerabilitycatchsquare WP Social Widget
- CVE-2025-57982WordPress Advance Portfolio Grid plugin <= 1.07.6 - Cross Site Scripting (XSS) vulnerabilityWPBean Advance Portfolio Grid
- CVE-2025-57983WordPress BP Disable Activation Reloaded Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) VulnerabilityDamian BP Disable Activation Reloaded
- CVE-2025-57984WordPress MakeStories (for Google Web Stories) Plugin <= 3.0.4 - Server Side Request Forgery (SSRF) VulnerabilityPratik Ghela MakeStories
- CVE-2025-57985WordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control VulnerabilityMantraBrain Ultimate Watermark
- CVE-2025-57986WordPress WP Subtitle plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerabilityhusani WP Subtitle
- CVE-2025-57987WordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control VulnerabilityThimPress WP Events Manager
- CVE-2025-57988WordPress Uncanny Toolkit for LearnDash Plugin <= 3.7.0.3 - Cross Site Scripting (XSS) VulnerabilityUncanny Owl Uncanny Toolkit for LearnDash
- CVE-2025-57989WordPress WordPress Widgets Shortcode Plugin <= 1.0.3 - Cross Site Scripting (XSS) VulnerabilityBrajesh Singh WordPress Widgets Shortcode
- CVE-2025-57990WordPress Blog Designer Plugin <= 3.1.8 - Broken Access Control Vulnerabilitysolwininfotech Blog Designer
- CVE-2025-57991WordPress Clariti Plugin <= 1.2.1 - Broken Access Control VulnerabilityClariti
- CVE-2025-57992WordPress Mail Baby SMTP plugin <= 2.8 - Cross Site Request Forgery (CSRF) vulnerabilityInterServer Mail Baby SMTP
- CVE-2025-57993WordPress Geolocation IP Detection plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerabilityBenjamin Pick Geolocation IP Detection
- CVE-2025-57994WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) VulnerabilitySayful Islam Upcoming Events Lists
- CVE-2025-57995WordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control VulnerabilityDethemeKit For Elementor
- CVE-2025-57996WordPress Buckets Plugin <= 0.3.9 - Cross Site Scripting (XSS) Vulnerabilitymatthewordie Buckets
- CVE-2025-57997WordPress Trustpilot Reviews Plugin <= 2.5.925 - Broken Access Control VulnerabilityTrustpilot Reviews
- CVE-2025-57998WordPress E-namad & Shamed Logo Manager Plugin <= 2.2 - Cross Site Scripting (XSS) VulnerabilityHamid Reza Yazdani E-namad & Shamed Logo Manager
- CVE-2025-57999WordPress WPKoi Templates for Elementor Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerabilitywpkoithemes WPKoi Templates for Elementor
- CVE-2025-58000WordPress Memberful plugin <= 1.75.0 - Broken Access Control vulnerabilityMemberful - Membership Plugin
- CVE-2025-58001WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerabilitySyed Balkhi Compact Archives
- CVE-2025-58002WordPress GD bbPress Tools Plugin <= 3.5.3 - Cross Site Scripting (XSS) VulnerabilityMilan Petrovic GD bbPress Tools
- CVE-2025-58003WordPress Javo Core Plugin <= 3.0.0.266 - Broken Access Control Vulnerabilityjavothemes Javo Core
- CVE-2025-58004WordPress DriCub Theme <= 2.9 - Broken Access Control VulnerabilitySmartDataSoft DriCub
- CVE-2025-58005WordPress DriCub Theme <= 2.9 - Server Side Request Forgery (SSRF) VulnerabilitySmartDataSoft DriCub
- CVE-2025-58006WordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerabilityCRM Perks WP Gravity Forms Keap/Infusionsoft
- CVE-2025-58007WordPress Social Pug Plugin <= 1.35.2 - Sensitive Data Exposure VulnerabilityNerdPress Hubbub Lite
- CVE-2025-58008WordPress Participants Database Plugin <= 2.7.6.3 - Cross Site Scripting (XSS) Vulnerabilityxnau webdesign Participants Database
- CVE-2025-58009WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerabilitycodepeople CP Multi View Event Calendar
- CVE-2025-58010WordPress SV Proven Expert Plugin <= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerabilitystraightvisions SV Proven Expert
- CVE-2025-58011WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerabilityAlex Content Mask
- CVE-2025-58012WordPress Content Mask plugin <= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerabilityAlex Content Mask
- CVE-2025-58014WordPress Quiz Maker Plugin <= 6.7.0.64 - Cross Site Request Forgery (CSRF) VulnerabilityAys Pro Quiz Maker
- CVE-2025-58015WordPress Quiz Maker Plugin <= 6.7.0.65 - Sensitive Data Exposure VulnerabilityAys Pro Quiz Maker
- CVE-2025-58016WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control VulnerabilityCodexpert CF7 Submissions
- CVE-2025-58017WordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerabilitybdthemes Ultimate Store Kit Elementor Addons
- CVE-2025-58018WordPress Mail Subscribe List Plugin <= 2.1.10 - Cross Site Scripting (XSS) VulnerabilityRichard Leishman Mail Subscribe List
- CVE-2025-58019WordPress Search Atlas SEO Plugin <= 2.5.4 - Cross Site Scripting (XSS) VulnerabilitySearch Atlas Group Search Atlas SEO
- CVE-2025-58020WordPress Theater for WordPress plugin <= 0.18.8 - Cross Site Scripting (XSS) vulnerabilityJeroen Schmit Theater for WordPress
- CVE-2025-58021WordPress List Child Pages Shortcode Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerabilitydouglaskarr List Child Pages Shortcode
- CVE-2025-58022WordPress ShortCode Plugin <= 0.8.1 - Cross Site Scripting (XSS) Vulnerabilitymaxpagels ShortCode
- CVE-2025-58023WordPress Genealogical Tree plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerabilityakdevs Genealogical Tree
- CVE-2025-58025WordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) Vulnerabilityaverta Master Slider
- CVE-2025-58026WordPress Termageddon: Cookie Consent & Privacy Compliance Plugin <= 1.8.1 - Cross Site Scripting (XSS) VulnerabilityTermageddon: Cookie Consent & Privacy Compliance
- CVE-2025-58027WordPress NGG Smart Image Search Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerabilitywpo-HR NGG Smart Image Search
- CVE-2025-58028WordPress Designil PDPA Thailand plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityAum Watcharapon Designil PDPA Thailand
- CVE-2025-58029WordPress Classic Widgets with Block-based Widgets Plugin <= 1.0.1 - Broken Access Control VulnerabilitySumit Singh Classic Widgets with Block-based Widgets
- CVE-2025-58030WordPress Page-list Plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerabilitywebvitaly Page-list
- CVE-2025-58031WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) VulnerabilityNextendweb Nextend Facebook Connect
- CVE-2025-58032WordPress WP Compiler Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) VulnerabilityBytes.co WP Compiler
- CVE-2025-58033WordPress Draft Plugin <= 3.0.9 - Cross Site Scripting (XSS) Vulnerabilityleeshadle Draft
- CVE-2025-58199WordPress Fastly plugin <= 1.2.28 - Cross Site Request Forgery (CSRF) vulnerabilityFastly
- CVE-2025-58200WordPress Flexible FAQ Plugin <= 0.2 - Cross Site Request Forgery (CSRF) VulnerabilityBage Flexible FAQ
- CVE-2025-58219WordPress Show Pages List Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) VulnerabilityLIJE Show Pages List
- CVE-2025-58220WordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) VulnerabilityTecheshta Card Elements for WPBakery
- CVE-2025-58221WordPress PilotPress Plugin <= 2.0.36 - Broken Access Control VulnerabilityONTRAPORT PilotPress
- CVE-2025-58222WordPress Team Manager plugin <= 2.6.8 - Broken Access Control vulnerabilityDynamic Web Lab Team Manager
- CVE-2025-58224WordPress Printeers Print & Ship Plugin <= 1.17.0 - Cross Site Request Forgery (CSRF) VulnerabilityPrinteers Print & Ship
- CVE-2025-58223WordPress VoucherPress Plugin <= 1.5.7 - Cross Site Scripting (XSS) VulnerabilityChris Taylor VoucherPress
- CVE-2025-58226WordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerabilityiberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Ima…
- CVE-2025-58227WordPress Podlove Subscribe button Plugin <= 1.3.11 - Cross Site Scripting (XSS) VulnerabilityAlexander Lueken Podlove Subscribe button
- CVE-2025-58228WordPress Quick View for WooCommerce Plugin <= 2.2.16 - Cross Site Scripting (XSS) VulnerabilityShapedPlugin Quick View for WooCommerce
- CVE-2025-58229WordPress Sitekit Plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerabilitywebvitaly Sitekit
- CVE-2025-58230WordPress ZoloBlocks plugin <= 2.3.12 - Cross Site Scripting (XSS) vulnerabilitybdthemes ZoloBlocks
- CVE-2025-58231WordPress Bitly plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerabilitybitlydeveloper Bitly
- CVE-2025-58232WordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) VulnerabilityIckata Image Editor by Pixo
- CVE-2025-58233WordPress SQL Chart Builder Plugin <= 2.3.7.2 - Cross Site Scripting (XSS) VulnerabilityGuaven Labs SQL Chart Builder
- CVE-2025-58234WordPress JS Job Manager Plugin <= 2.0.2 - Cross Site Scripting (XSS) VulnerabilityJoomSky JS Job Manager
- CVE-2025-58235WordPress Front End Users plugin <= 3.2.35 - Cross Site Scripting (XSS) vulnerabilityRustaurius Front End Users
- CVE-2025-58236WordPress Force Update Translations plugin <= 0.5 - Cross Site Request Forgery (CSRF) vulnerabilityMayo Moriyama Force Update Translations
- CVE-2025-58237WordPress LC Wizard plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerabilityNiaj Morshed LC Wizard
- CVE-2025-58238WordPress PilotPress Plugin <= 2.0.36 - Cross Site Scripting (XSS) VulnerabilityONTRAPORT PilotPress
- CVE-2025-58239WordPress WP Category Dropdown Plugin <= 1.9 - Cross Site Scripting (XSS) VulnerabilityChandrika Sista WP Category Dropdown
- CVE-2025-58240WordPress xili-tidy-tags Plugin <= 1.12.06 - Cross Site Scripting (XSS) VulnerabilityMichel - xiligroup dev xili-tidy-tags
- CVE-2025-58241WordPress SnapWidget Social Photo Feed Widget Plugin <= 1.1.0 - Cross Site Scripting (XSS) VulnerabilitySnapWidget Social Photo Feed Widget
- CVE-2025-58242WordPress Bg Church Memos Plugin <= 1.1 - Cross Site Scripting (XSS) VulnerabilityVadim Bogaiskov Bg Church Memos
- CVE-2025-58245WordPress Portfolio Plugin <= 2.58 - Cross Site Scripting (XSS) Vulnerabilitybestweblayout Portfolio
- CVE-2025-58247WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerabilitytemplateinvaders TI WooCommerce Wishlist
- CVE-2025-58248WordPress Pinterest Pinboard Widget Plugin <= 1.0.7 - Cross Site Scripting (XSS) Vulnerabilitycodefish Pinterest Pinboard Widget
- CVE-2025-58249WordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure VulnerabilityThemeum Qubely
- CVE-2025-58251WordPress Sticky Header Effects for Elementor Plugin <= 2.1.2 - Broken Access Control VulnerabilityPOSIMYTH Sticky Header Effects for Elementor
- CVE-2025-58252WordPress Getwid Plugin <= 2.1.2 - Sensitive Data Exposure Vulnerabilityjetmonsters Getwid
- CVE-2025-58253WordPress Real Estate Manager Plugin <= 7.3 - Cross Site Scripting (XSS) VulnerabilityRameez Iqbal Real Estate Manager
- CVE-2025-58254WordPress StylePress for Elementor Plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerabilitydtbaker StylePress for Elementor
- CVE-2025-58256WordPress DOAJ Export Plugin <= 1.0.4 - Cross Site Scripting (XSS) VulnerabilityJonathan Brinley DOAJ Export
- CVE-2025-58257WordPress Verowa Connect plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityPicture-Planet Verowa Connect
- CVE-2025-58258WordPress Lazy Blocks Plugin <= 4.1.0 - Broken Access Control VulnerabilitynK Lazy Blocks
- CVE-2025-58260WordPress Highlight and Share – Social Text and Image Sharing plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityRonald Huereca Highlight and Share
- CVE-2025-58263WordPress BuddyPress Notification Widget Plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityBuddyDev BuddyPress Notification Widget
- CVE-2025-58264WordPress JupiterX Core Plugin <= 4.11.0 - Cross Site Scripting (XSS) Vulnerabilityartbees JupiterX Core
- CVE-2025-58265WordPress Events Manager – OpenStreetMaps Plugin <= 4.2.1 - Cross Site Scripting (XSS) VulnerabilityStonehenge Creations Events Manager – OpenStreetMaps
- CVE-2025-58266WordPress Gianism plugin <= 6.0.0 - Cross Site Scripting (XSS) vulnerabilityFumiki Takahashi Gianism
- CVE-2025-58269WordPress WP Project Manager Plugin <= 2.6.25 - Sensitive Data Exposure VulnerabilityweDevs WP Project Manager
- CVE-2025-58271WordPress AnyClip Luminous Studio Plugin <= 1.3.3 - Cross Site Scripting (XSS) VulnerabilityAnyClip Video Platform AnyClip Luminous Studio
- CVE-2025-58645WordPress Gravitate Automated Tester Plugin <= 1.4.5 - Cross Site Scripting (XSS) VulnerabilityGravitate Automated Tester
- CVE-2025-58646WordPress Mobi2Go Plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerabilitychtombleson Mobi2Go
- CVE-2025-58647WordPress Simple Restaurant Menu Plugin <= 1.2 - Cross Site Scripting (XSS) VulnerabilityWill.I.am Simple Restaurant Menu
- CVE-2025-58648WordPress Simple JWT Login plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerabilityNicu Micle Simple JWT Login
- CVE-2025-58649WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Sensitive Data Exposure VulnerabilitySyed Balkhi All In One SEO Pack
- CVE-2025-58650WordPress All In One SEO Pack Plugin <= 4.8.7.1 - Broken Access Control VulnerabilitySyed Balkhi All In One SEO Pack
- CVE-2025-58651WordPress PlayerJS Plugin <= 2.24 - Cross Site Scripting (XSS) VulnerabilityPlayerJS
- CVE-2025-58652WordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) VulnerabilityThemepoints Carousel Ultimate
- CVE-2025-58653WordPress JSM file_get_contents() Shortcode Plugin <= 2.7.1 - Cross Site Scripting (XSS) VulnerabilityJS Morisset JSM file_get_contents() Shortcode
- CVE-2025-58654WordPress xili-language Plugin <= 2.21.3 - Cross Site Scripting (XSS) VulnerabilityMichel - xiligroup dev xili-language
- CVE-2025-58655WordPress Category Featured Images Plugin <= 1.1.8 - Cross Site Scripting (XSS) VulnerabilityMat Category Featured Images
- CVE-2025-58656WordPress Estonian Shipping Methods for WooCommerce Plugin <= 1.7.2 - Sensitive Data Exposure VulnerabilityRisto Niinemets Estonian Shipping Methods for WooCommerce
- CVE-2025-58658WordPress Proof Factor – Social Proof Notifications Plugin <= 1.0.5 - Cross Site Scripting (XSS) VulnerabilityProof Factor – Social Proof Notifications
- CVE-2025-58659WordPress Helpie FAQ plugin <= 1.45 - Sensitive Data Exposure vulnerabilityEssekia Helpie FAQ
- CVE-2025-58660WordPress Oshine Core Plugin <= 1.5.5 - Broken Access Control Vulnerabilitybrandexponents Oshine Core
- CVE-2025-58661WordPress eZee Online Hotel Booking Engine Plugin <= 1.0.0 - Cross Site Scripting (XSS) VulnerabilityeZee Technosys eZee Online Hotel Booking Engine
- CVE-2025-58663WordPress Qubely Plugin <= 1.8.14 - Broken Access Control VulnerabilityThemeum Qubely
- CVE-2025-58664WordPress Text To Speech TTS Accessibility plugin <= 1.9.30 - Broken Access Control vulnerabilityAzizul Hasan Text To Speech TTS Accessibility
- CVE-2025-58665WordPress Form Generator for WordPress Plugin <= 1.52 - Cross Site Scripting (XSS) Vulnerabilitytmontg1 Form Generator for WordPress
- CVE-2025-58666WordPress Website Chat Button: Kommo integration Plugin <= 1.3.1 - Broken Access Control VulnerabilityWebsite Chat Button: Kommo integration
- CVE-2025-58667WordPress ListingPro Reviews plugin < 2.9.11 - Broken Access Control vulnerabilityCridioStudio ListingPro Reviews
- CVE-2025-58668WordPress WPLMS theme <= 4.970 - Broken Access Control vulnerabilityVibeThemes WPLMS
- CVE-2025-58669WordPress Magento 2 WordPress Integration plugin <= 1.4.2.1 - Cross Site Scripting (XSS) vulnerabilityModern Minds Magento 2 WordPress Integration
- CVE-2025-58672WordPress WP User Frontend Plugin <= 4.1.12 - Broken Access Control VulnerabilityweDevs WP User Frontend
- CVE-2025-58673WordPress WP User Frontend Plugin <= 4.1.12 - Content Injection VulnerabilityweDevs WP User Frontend
- CVE-2025-58675WordPress Interact: Embed A Quiz On Your Site Plugin <= 3.1 - Cross Site Request Forgery (CSRF) Vulnerabilitytryinteract Interact: Embed A Quiz On Your Site
- CVE-2025-58678WordPress Accordion Plugin <= 2.3.15 - Broken Access Control VulnerabilityPickPlugins Accordion
- CVE-2025-58679WordPress AppMySite plugin <= 3.15.0 - Broken Access Control vulnerabilityAppMySite
- CVE-2025-58680WordPress Gutentor plugin <= 3.5.2 - Broken Access Control vulnerabilityGutentor
- CVE-2025-58681WordPress Easy Quotes Plugin <= 1.2.4 - Broken Access Control VulnerabilityJürgen Müller Easy Quotes
- CVE-2025-58682WordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerabilityTimur Kamaev Kama Click Counter
- CVE-2025-58683WordPress Last Updated Shortcode Plugin <= 1.0.1 - Cross Site Scripting (XSS) VulnerabilityLuke Mlsna Last Updated Shortcode
- CVE-2025-58684WordPress Logo Showcase plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilityThemepoints Logo Showcase
- CVE-2025-58685WordPress Cecabank WooCommerce plugin plugin <= 0.3.4 - Broken Access Control vulnerabilityCecabank WooCommerce Plugin
- CVE-2025-58689WordPress Tapfiliate Plugin <= 3.2.2 - Cross Site Scripting (XSS) VulnerabilityTapfiliate
- CVE-2025-58691WordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) VulnerabilityRussell Jamieson Genesis Club Lite
- CVE-2025-58702WordPress MarketKing Plugin <= 2.0.92 - Cross Site Scripting (XSS) VulnerabilityWebWizards MarketKing
- CVE-2025-58703WordPress Skyword API Plugin Plugin <= 2.5.3 - Cross Site Scripting (XSS) VulnerabilitySkyword API Plugin
- CVE-2025-58704WordPress WP Delete User Accounts Plugin <= 1.2.4 - Cross Site Scripting (XSS) VulnerabilityRen Ventura WP Delete User Accounts
- CVE-2025-59418BunnyPad Vulnerable to Buffer Overflow When Opening Files of Size 20MB or GreaterGSYT-Productions BunnyPad-SRC
- CVE-2025-10809Campcodes Online Learning Management System department.php sql injectionCampcodes Online Learning Management System
- CVE-2025-10808Campcodes Farm Management System uploadProduct.php sql injectionCampcodes Farm Management System
- CVE-2025-10807Campcodes Online Beauty Parlor Management System edit-customer-detailed.php sql injectionCampcodes Online Beauty Parlor Management System
- CVE-2025-10806Campcodes Online Beauty Parlor Management System bwdates-reports-details.php sql injectionCampcodes Online Beauty Parlor Management System
- CVE-2025-43807Stored cross-site scripting (XSS) vulnerability in the notifications widget in Liferay Portal 7.4.0 through 7.4.3.112, and Liferay DXP 2023.Liferay Portal · Liferay DXP +1
- CVE-2025-59413CubeCart Unauthorized Newsletter Unsubscription via force_unsubscribe Parametercubecart
- CVE-2025-59412CubeCart Vulnerable to HTML Injection in Product Reviews Allows Malicious Links and Defacementcubecart
- CVE-2025-59411CubeCart Stored/Reflected HTML Injection Vulnerability in Contact Enquirycubecart
- CVE-2025-10805Campcodes Online Beauty Parlor Management System add-services.php sql injectionCampcodes Online Beauty Parlor Management System
- CVE-2025-10804Campcodes Online Beauty Parlor Management System add-customer.php sql injectionCampcodes Online Beauty Parlor Management System
- CVE-2025-36037IBM webMethods Integration server-side request forgeryIBM webMethods Integration
- CVE-2025-10802code-projects Online Bidding System remove.php sql injectioncode-projects Online Bidding System
- CVE-2025-10801SourceCodester Pet Grooming Management Software edit_tax.php sql injectionSourceCodester Pet Grooming Management Software
- CVE-2025-10800itsourcecode Online Discussion Forum index.php sql injectionitsourcecode Online Discussion Forum
- CVE-2025-10799code-projects Hostel Management System index.php sql injectioncode-projects Hostel Management System
- CVE-2025-10798code-projects Hostel Management System index.php sql injectioncode-projects Hostel Management System
- CVE-2025-10797code-projects Hostel Management System index.php sql injectioncode-projects Hostel Management System
- CVE-2025-10796code-projects Hostel Management System login.php sql injectioncode-projects Hostel Management System
- CVE-2025-10795code-projects Online Bidding System bidupdate.php sql injectioncode-projects Online Bidding System
- CVE-2025-10794PHPGurukul Car Rental Project search.php cross site scriptingPHPGurukul Car Rental Project
- CVE-2025-46711GPU DDK - NULL Pointer dereference occurs in LockHandle on bridge entry when connection misusedImagination Technologies Graphics DDK
- CVE-2025-25177GPU DDK - Roll-back of pvr_exp_fence not in finalised state can cause UAFImagination Technologies Graphics DDK
- CVE-2025-10793code-projects E-Commerce Website admin_account_delete.php sql injectioncode-projects E-Commerce Website
- CVE-2025-9035Reflected XSS in Horato Internet Technologies' Virtual Library PlatformHorato Internet Technologies Ind. and Trade Virtual Library…
- CVE-2025-10791code-projects Online Bidding System index.php sql injectioncode-projects Online Bidding System
- CVE-2025-8079Reflected XSS in Akıllı Ticaret Software Technologies' Smart Trade E-CommerceAkıllı Ticaret Software Technologies Ltd. Smart Trade E-Com…
- CVE-2025-10790SourceCodester Simple Forum Discussion System ajax.php sql injectionSourceCodester Simple Forum Discussion System
- CVE-2025-0875IDOR in Proliz Software's OBSPROLIZ Computer Software Hardware Service Trade Ltd. OBS
- CVE-2025-10789SourceCodester Online Hotel Reservation System deleteslide.php sql injectionSourceCodester Online Hotel Reservation System
- CVE-2025-10788SourceCodester Online Hotel Reservation System deleteroominventory.php sql injectionSourceCodester Online Hotel Reservation System
- CVE-2025-10787MuYuCMS Add Fiend Link index.html server-side request forgeryMuYuCMS
- CVE-2025-10786Campcodes Grocery Sales and Inventory System ajax.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-10785Campcodes Grocery Sales and Inventory System manage_user.php sql injectionCampcodes Grocery Sales and Inventory System
- CVE-2025-9541Markup Markdown < 3.20.10 - Contributor+ Stored XSSMarkup Markdown
- CVE-2025-9540Markup Markdown < 3.20.10 - Contributor+ Stored XSSMarkup Markdown
- CVE-2025-9487Admin and Site Enhancements < 7.9.8 - Authenticated Stored XSS via SVGAdmin and Site Enhancements
- CVE-2025-9115Etsy Shop < 3.0.7 - Reflected XSS via $_SERVER['REQUEST_URI']Etsy Shop
- CVE-2025-10784Campcodes Online Learning Management System edit_subject.php sql injectionCampcodes Online Learning Management System
- CVE-2025-10783Campcodes Online Learning Management System add_subject.php sql injectionCampcodes Online Learning Management System
- CVE-2025-10782Campcodes Online Learning Management System class.php sql injectionCampcodes Online Learning Management System
- CVE-2025-10781Campcodes Online Learning Management System edit_class.php sql injectionCampcodes Online Learning Management System
- CVE-2025-10780CodeAstro Simple Pharmacy Management view.php sql injectionCodeAstro Simple Pharmacy Management
- CVE-2025-10778Smartstore Gift Voucher confirm race conditionSmartstore
- CVE-2025-10777JSC R7 R7-Office Document Server downloadas path traversalJSC R7 R7-Office Document Server
- CVE-2025-10776LionCoders SalePro POS Login cleartext transmissionLionCoders SalePro POS
- CVE-2025-10775Wavlink WL-NU516U1 login.cgi sub_4012A0 os command injectionWavlink WL-NU516U1
- CVE-2025-10774Ruijie 6000-E10 sub_commit.php os command injectionRuijie 6000-E10
- CVE-2025-52367Cross Site Scripting vulnerability in PivotX CMS v.3.0.0 RC 3 allows a remote attacker to execute arbitrary code via the subtitle field.
- CVE-2025-55885SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Lign before v.2025-04-23 allows a remote attacker to escalate pri
- CVE-2025-55886An Insecure Direct Object Reference (IDOR) vulnerability was discovered in ARD.
- CVE-2025-55887Cross-Site Scripting (XSS) vulnerability was discovered in the meal reservation service ARD.
- CVE-2025-56075A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v
- CVE-2025-57203MagicProject AI version 9.1 is affected by a Cross-Site Scripting (XSS) vulnerability within the chatbot generation feature available to aut
- CVE-2025-57204Stocky POS with Inventory Management & HRM (ui-lib) version 5.0 is affected by a Stored Cross-Site Scripting (XSS) vulnerability within the
- CVE-2025-57205iNiLabs School Express (SMS Express) 6.2 is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the content-management features
- CVE-2025-57433The 2wcom IP-4c 2.15.5 device's web interface includes an information disclosure vulnerability.
- CVE-2025-57438The 2wcom IP-4c 2.15.5 device suffers from a Broken Access Control vulnerability.
- CVE-2025-57682Directory Traversal vulnerability in Papermark 0.20.0 and prior allows authenticated attackers to retrieve arbitrary files from an S3 bucket
- CVE-2025-59797Profession Fit 5.0.99 Build 44910 allows authorization bypass via a direct request for /api/challenges/{id} and also URLs for eversports, thProfession Fit
- CVE-2025-59798Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdf_write_cmap in devices/vector/gdevpdtw.c.Artifex Ghostscript
- CVE-2025-59799Artifex Ghostscript through 10.05.1 has a stack-based buffer overflow in pdfmark_coerce_dest in devices/vector/gdevpdfm.c via a large size vArtifex Ghostscript
- CVE-2025-59800In Artifex Ghostscript through 10.05.1, ocr_begin_page in devices/gdevpdfocr.c has an integer overflow that leads to a heap-based buffer oveArtifex Ghostscript
- CVE-2025-59801In Artifex GhostXPS before 10.06.0, there is a stack-based buffer overflow in xps_unpredict_tiff in xpstiff.c because the samplesperpixel vaArtifex GhostXPS