CVEs published December 31, 2025
218 CVEs were published on December 31, 2025: 3 critical, 56 high.
- Published
- 218
- Critical
- 3
- High
- 56
- Medium
- 156
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- FontForge
- 12
- Esri ArcGIS Server
- 9
- EyouCMS
- 3
- QNO Technology VPN Firewall
- 3
- Channelize.io Team Live Shopping & Shoppable Videos For Woo…
- 2
- Digages Direct Payments WP
- 2
- eleopard Behance Portfolio Manager
- 2
- infiniflow ragflow
- 2
- Kohana KodiCMS
- 2
- Moxa NPort 6100-G2/6200-G2 Series
- 2
Critical 3
High 56
- CVE-2025-69286RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerabilityinfiniflow ragflow
- CVE-2023-7332PocketMine-MP < 4.18.1 Improper Validation of Dropped Item Count Allows Remote Server Crashpmmp PocketMine-MP · pocketmine/pocketmine-mp
- CVE-2025-68700RAGFlow Remote Code Execution Vulnerabilityinfiniflow ragflow
- CVE-2015-10145Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.shGargoyle Router Management Utility
- CVE-2025-53235WordPress Easy Social plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityosuthorpe Easy Social
- CVE-2025-52739WordPress Sala theme <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilityuxper Sala
- CVE-2025-50053WordPress Blappsta Mobile App Plugin – Your native, mobile iPhone App and Android App Plugin <= 0.8.8.8 - Cross Site Scripting (XSS) Vulnerabilitynebelhorn Blappsta Mobile App Plugin – Your native, mobile…
- CVE-2025-47566WordPress ZoomSounds plugin <= 6.91 - Reflected Cross Site Scripting (XSS) vulnerabilityZoomSounds
- CVE-2025-31054WordPress Bloggie theme <= 2.0.8 - Cross Site Scripting (XSS) VulnerabilityThemefy Bloggie
- CVE-2025-30628WordPress Amazon Affiliates Addon for WPBakery Page Builder (formerly Visual Composer) plugin <= 1.2 - SQL Injection VulnerabilityAA-Team Amazon Affiliates Addon for WPBakery Page Builder
- CVE-2025-28949WordPress Mediabay - WordPress Media Library Folders <= 1.4 - SQL Injection VulnerabilityCodedraft Mediabay - WordPress Media Library Folders
- CVE-2025-23757WordPress ZD Scribd iPaper plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityProloy Chakroborty ZD Scribd iPaper
- CVE-2025-23719WordPress ZhinaTwitterWidget plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityzckevin ZhinaTwitterWidget
- CVE-2025-23707WordPress En Masse plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityMatamko En Masse
- CVE-2025-23705WordPress Zielke Design Project Gallery plugin <= 2.5.0 - Reflected Cross Site Scripting (XSS) vulnerabilityTerry Zielke Zielke Design Project Gallery
- CVE-2025-23667WordPress custom-post-edit plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerabilityChristopher Churchill custom-post-edit
- CVE-2021-47747meterN 1.2.3 Authenticated Remote Code Execution via Admin ScriptsmeterN
- CVE-2021-47745Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection via Firmware UpgradeCypress
- CVE-2021-47742Epic Games Psyonix Rocket League <=1.95 Elevation of Privileges via Insecure PermissionsEpic Games Psyonix Rocket League
- CVE-2021-47741ZBL EPON ONU Broadband Router V100R001 Privilege Escalation via Configuration EndpointZblchina ZBL EPON ONU Broadband Router
- CVE-2021-47726NuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration BackupNuCom 11N Wireless Router
- CVE-2020-36903Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service PathSelea CarPlateServer
- CVE-2025-34468libcoap Stack-Based Buffer Overflow in Address Resolution DoS or Potential RCElibcoap
- CVE-2025-23608WordPress LIVE TV plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerabilityOmar Mohamed Mohamoud LIVE TV
- CVE-2025-15389QNO Technology｜VPN Firewall - OS Command InjectionQNO Technology VPN Firewall
- CVE-2025-49028WordPress Zoho ZeptoMail plugin <= 3.3.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilityZoho Mail Zoho ZeptoMail
- CVE-2025-15388QNO Technology｜VPN Firewall - OS Command InjectionQNO Technology VPN Firewall
- CVE-2025-15387QNO Technology｜VPN Firewall - Insufficient EntropyQNO Technology VPN Firewall
- CVE-2025-15017A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface.Moxa NPort 5000AI-M12 Series · Moxa NPort 5100 Series +9
- CVE-2025-2026The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a nullMoxa NPort 6100-G2/6200-G2 Series
- CVE-2025-1977The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenMoxa NPort 6100-G2/6200-G2 Series
- CVE-2025-15279FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityFontForge
- CVE-2025-15278FontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution VulnerabilityFontForge
- CVE-2025-15277FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityFontForge
- CVE-2025-15276FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution VulnerabilityFontForge
- CVE-2025-15280FontForge SFD File Parsing Use-After-Free Remote Code Execution VulnerabilityFontForge
- CVE-2025-15275FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityFontForge
- CVE-2025-15274FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityFontForge
- CVE-2025-15273FontForge PFB File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityFontForge
- CVE-2025-15272FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityFontForge
- CVE-2025-15271FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityFontForge
- CVE-2025-15270FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution VulnerabilityFontForge
- CVE-2025-15269FontForge SFD File Parsing Use-After-Free Remote Code Execution VulnerabilityFontForge
- CVE-2025-13029Knowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User DeletionKnowband Mobile App Builder
- CVE-2025-49342WordPress Custom Style plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilitymerzedes Custom Style
- CVE-2025-49353WordPress Noindex by Path plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilityMarcin Kijak Noindex by Path
- CVE-2025-68885WordPress Custom Post Status plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerabilitypage-carbajal Custom Post Status
- CVE-2025-49354WordPress Recent Posts From Each Category plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerabilityMindstien Technologies Recent Posts From Each Category
- CVE-2025-49343WordPress Social Profilr plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilitysocialprofilr Social Profilr
- CVE-2025-49344WordPress SensitiveTagCloud plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerabilityreneade SensitiveTagCloud
- CVE-2025-49345WordPress WP-EasyArchives plugin <= 3.1.2 - Cross Site Request Forgery (CSRF) vulnerabilitymg12 WP-EasyArchives
- CVE-2025-49346WordPress Simple Archive Generator plugin <= 5.2 - Cross Site Request Forgery (CSRF) vulnerabilitypeterwsterling Simple Archive Generator
- CVE-2025-59137WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Request Forgery (CSRF) vulnerabilityeleopard Behance Portfolio Manager
- CVE-2025-15371Tenda i24 Shadow File hard-coded credentialsTenda i24 · Tenda 4G03 Pro +5
- CVE-2025-61037A local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22).
- CVE-2025-64699An incorrect NULL DACL issue exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22).
Medium, low and unrated 159
- CVE-2025-69412KDE messagelib before 25.11.90 ignores SSL errors for threatMatches:find in the Google Safe Browsing Lookup API (aka phishing API), which miKDE messagelib
- CVE-2025-67711Reflected XSS vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-67710Stored XSS vulnerability in ArcGIS ServerEsri ArcGIS Server
- CVE-2025-67709There is a cross site scripting issue in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-67708Reflected cross-site scripting (XSS) vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-67707Unvalidated File Upload vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-67706Unvalidated File Upload vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-67705Reflected XSS vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-67704Stored XSS vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-67703Stored XSS vulnerability in ArcGIS Server.Esri ArcGIS Server
- CVE-2025-15398Uasoft badaso Token BadasoAuthController.php forgetPassword password recoveryUasoft badaso
- CVE-2025-34469Cowrie < 2.9.0 Unrestricted wget/curl Emulation Enables SSRF-Based DDoS AmplificationCowrie
- CVE-2023-7331PKrystian Full-Stack-Bank User sql injectionPKrystian Full-Stack-Bank
- CVE-2025-28973WordPress Pro Bulk Watermark Plugin for WordPress <= 2.0 - Path Traversal VulnerabilityAA-Team Pro Bulk Watermark Plugin for WordPress
- CVE-2025-66144WordPress Worker for Elementor plugin <= 1.0.10 - Broken Access Control vulnerabilitymerkulove Worker for Elementor
- CVE-2025-66145WordPress Worker for WPBakery plugin <= 1.1.1 - Broken Access Control vulnerabilitymerkulove Worker for WPBakery
- CVE-2025-66146WordPress Logger for Elementor plugin <= 1.0.9 - Broken Access Control vulnerabilitymerkulove Logger for Elementor
- CVE-2025-66148WordPress Conformer for Elementor plugin <= 1.0.7 - Broken Access Control vulnerabilitymerkulove Conformer for Elementor
- CVE-2025-15394iCMS POST Parameter ConfigAdmincp.php save code injectioniCMS
- CVE-2021-47743COMMAX Biometric Access Control System 1.0.0 Reflected XSS via Cookie ParametersCOMMAX Co. COMMAX Biometric Access Control System
- CVE-2021-47740KZTech JT3500V 4G LTE CPE 2.0.1 Insufficient Session Expiration VulnerabilityKZ Broadband Technologies JT3500V · KZ Broadband Techno… +13
- CVE-2021-47725STVS ProVision 5.9.10 Authenticated Reflected Cross-Site Scripting via Files ParameterSTVS SA STVS ProVision
- CVE-2025-34467ZwiiCMS < 13.7.00 Lock Persistence Authenticated DoS Against Administrative Pagesfredtempez ZwiiCMS
- CVE-2025-66149WordPress UnGrabber plugin <= 3.1.3 - Broken Access Control vulnerabilitymerkulove UnGrabber
- CVE-2025-66150WordPress Appender plugin <= 1.1.1 - Broken Access Control vulnerabilitymerkulove Appender
- CVE-2025-66151WordPress Countdowner for Elementor plugin <= 1.0.4 - Broken Access Control vulnerabilitymerkulove Countdowner for Elementor
- CVE-2025-66152WordPress Criptopayer for Elementor plugin <= 1.0.1 - Broken Access Control vulnerabilitymerkulove Criptopayer for Elementor
- CVE-2025-15393Kohana KodiCMS Layout API Endpoint file.php save code injectionKohana KodiCMS
- CVE-2025-66153WordPress Headinger for Elementor plugin <= 1.1.4 - Broken Access Control vulnerabilitymerkulove Headinger for Elementor
- CVE-2025-15392Kohana KodiCMS Search API Endpoint page.php like sql injectionKohana KodiCMS
- CVE-2025-15391D-Link DIR-806A SSDP Request ssdpcgi_main command injectionD-Link DIR-806A
- CVE-2025-49355WordPress Accessibility Press plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityikaes Accessibility Press
- CVE-2025-49337WordPress Dashboard Beacon plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerabilityjanhenckens Dashboard Beacon
- CVE-2025-59135WordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerabilityeleopard Behance Portfolio Manager
- CVE-2025-62989WordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerabilityGora Tech Cooked
- CVE-2025-62088WordPress WordPress & WooCommerce Scraper plugin, Import Data from Any Site plugin <= 1.0.7 - Server Side Request Forgery (SSRF) vulnerabilityextendons WordPress & WooCommerce Scraper Plugin, Import Da…
- CVE-2025-59138WordPress Genemy theme <= 1.6.6 - Server Side Request Forgery (SSRF) vulnerabilityJthemes Genemy
- CVE-2019-25262elinicksic Razgover Chat Message send.php cross site scriptingelinicksic Razgover
- CVE-2025-66154WordPress Couponer for Elementor plugin <= 1.1.7 - Broken Access Control vulnerabilitymerkulove Couponer for Elementor
- CVE-2025-66155WordPress Questionar for Elementor plugin <= 1.1.7 - Broken Access Control vulnerabilitymerkulove Questionar for Elementor
- CVE-2025-66156WordPress Watcher for Elementor plugin <= 1.0.9 - Broken Access Control vulnerabilitymerkulove Watcher for Elementor
- CVE-2025-66157WordPress Sliper for Elementor plugin <= 1.0.10 - Broken Access Control vulnerabilitymerkulove Sliper for Elementor
- CVE-2025-66158WordPress Gmaper for Elementor plugin <= 1.0.9 - Broken Access Control vulnerabilitymerkulove Gmaper for Elementor
- CVE-2025-66159WordPress Walker for Elementor plugin <= 1.1.6 - Broken Access Control vulnerabilitymerkulove Walker for Elementor
- CVE-2025-66160WordPress Select Graphist for Elementor Graphist for Elementor plugin <= 1.2.10 - Broken Access Control vulnerabilitymerkulove Select Graphist for Elementor Graphist for Eleme…
- CVE-2025-63021WordPress Valenti Engine plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerabilitycodetipi Valenti Engine
- CVE-2025-62874WordPress AnyComment plugin <= 0.3.6 - Broken Access Control vulnerabilityAlexander AnyComment
- CVE-2025-62099WordPress Signature Add-On for Gravity Forms plugin <= 1.8.6 - Broken Access Control vulnerabilityapproveme Signature Add-On for Gravity Forms
- CVE-2025-62101WordPress Pardakht Delkhah plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityOmid Shamloo Pardakht Delkhah
- CVE-2025-63038WordPress WP Custom Admin Interface plugin <= 7.40 - Broken Access Control vulnerabilityNorthern Beaches Websites WP Custom Admin Interface
- CVE-2025-62078WordPress Easy Upload Files During Checkout plugin <= 3.0.0 - Broken Access Control vulnerabilityFahad Mahmood Easy Upload Files During Checkout
- CVE-2025-49339WordPress Direct Payments WP plugin <= 1.3.2 - Broken Access Control vulnerabilityDigages Direct Payments WP
- CVE-2025-49340WordPress Direct Payments WP plugin <= 1.3.2 - Sensitive Data Exposure vulnerabilityDigages Direct Payments WP
- CVE-2025-62083WordPress BoomDevs WordPress Coming Soon plugin plugin <= 1.0.4 - Sensitive Data Exposure vulnerabilityWP Messiah BoomDevs WordPress Coming Soon
- CVE-2025-62113WordPress Co-marquage service-public.fr plugin <= 0.5.77 - Cross Site Request Forgery (CSRF) vulnerabilityemendo_seb Co-marquage service-public.fr
- CVE-2025-62115WordPress Hide Plugins plugin <= 1.0.4 - Broken Access Control vulnerabilityThemeBoy Hide Plugins
- CVE-2025-62123WordPress WP Gmail SMTP plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerabilityinkthemes WP Gmail SMTP
- CVE-2025-49352WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerabilityYoOhw Studio Order Cancellation & Returns for WooCommerce
- CVE-2025-62087WordPress Sticky Notes for WP Dashboard plugin <= 1.2.4 - Broken Access Control vulnerabilityWeb Builder 143 Sticky Notes for WP Dashboard
- CVE-2025-63040WordPress Post Snippets plugin <= 4.0.11 - Cross Site Request Forgery (CSRF) vulnerabilitySaad Iqbal Post Snippets
- CVE-2025-49356WordPress Orders Chat for WooCommerce plugin <= 1.2.0 - Broken Access Control vulnerabilityMykola Lukin Orders Chat for WooCommerce
- CVE-2025-63004WordPress All in One Accessibility plugin <= 1.15 - Broken Access Control vulnerabilitySkynet Technologies USA All in One Accessibility
- CVE-2025-59130WordPress Appointify plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityAppointify
- CVE-2025-62130WordPress Accordion Slider Gallery plugin <= 2.7 - Broken Access Control vulnerabilitywpdiscover Accordion Slider Gallery
- CVE-2025-62131WordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerabilityStrategy11 Team Tasty Recipes Lite
- CVE-2025-62132WordPress Tasty Recipes Lite plugin <= 1.1.5 - Broken Access Control vulnerabilityStrategy11 Team Tasty Recipes Lite
- CVE-2025-62751WordPress Vireo theme <= 1.0.24 - Broken Access Control vulnerabilityextendthemes Vireo
- CVE-2025-62133WordPress FormFacade plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerabilitymanidoraisamy FormFacade
- CVE-2025-63014WordPress Gmedia Photo Gallery plugin <= 1.25.0 - Cross Site Request Forgery (CSRF) vulnerabilitySerhii Pasyuk Gmedia Photo Gallery
- CVE-2025-62089WordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerabilityMergado Pack
- CVE-2025-62084WordPress iNext Woo Pincode Checker plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityImdad Next Web iNext Woo Pincode Checker
- CVE-2025-62143WordPress Post Video Players plugin <= 1.163 - Sensitive Data Exposure vulnerabilitynicashmu Post Video Players
- CVE-2025-62148WordPress Robots.txt rewrite plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerabilityEugen Bobrowski Robots.txt rewrite
- CVE-2025-62080WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Cross Site Request Forgery (CSRF) vulnerabilityChannelize.io Team Live Shopping & Shoppable Videos For Woo…
- CVE-2025-62150WordPress History Timeline plugin <= 1.0.6 - Broken Access Control vulnerabilitythemesawesome History Timeline
- CVE-2025-62154WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One plugin <= 1.1.7 - Broken Access Control vulnerabilityrecorp AI Content Writing Assistant (Content Writer, ChatGP…
- CVE-2025-62114WordPress Download Media Library plugin <= 0.2.1 - Sensitive Data Exposure vulnerabilitymarcelotorres Download Media Library
- CVE-2025-62116WordPress AI Copilot plugin <= 1.5.2 - Broken Access Control vulnerabilityquadlayers AI Copilot
- CVE-2025-62122WordPress Trash Duplicate and 301 Redirect plugin <= 1.9.1 - Broken Access Control vulnerabilitysolwininfotech Trash Duplicate and 301 Redirect
- CVE-2025-62079WordPress WP Export Categories & Taxonomies plugin <= 1.0.3 - Broken Access Control vulnerabilityDamian WP Export Categories & Taxonomies
- CVE-2025-62126WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Sensitive Data Exposure vulnerabilityRazvan Stanga Varnish/Nginx Proxy Caching
- CVE-2025-49338WordPress Flowbox plugin <= 1.1.6 - Broken Access Control vulnerabilityFlowbox
- CVE-2025-62747WordPress Featured Image Generator plugin <= 1.3.4 - Broken Access Control vulnerabilityAum Watcharapon Featured Image Generator
- CVE-2025-15390PHPGurukul Small CRM edit-user.php authorizationPHPGurukul Small CRM
- CVE-2025-49334WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerabilityEduardo Villão MyD Delivery
- CVE-2025-59136WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerabilityEfí Bank Gerencianet Oficial
- CVE-2025-62129WordPress RestroPress plugin <= 3.2.7 - Broken Access Control vulnerabilityMagnigenie RestroPress
- CVE-2025-62092WordPress Wiremo plugin <= 1.4.99 - Broken Access Control vulnerabilityWiremo
- CVE-2025-62755WordPress GS Portfolio for Envato plugin <= 1.4.2 - Broken Access Control vulnerabilityGS Plugins GS Portfolio for Envato
- CVE-2025-63031WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Broken Access Control vulnerabilityWP Grids EasyTest – Simplify A/B Testing
- CVE-2025-62139WordPress Terms descriptions plugin <= 3.4.10 - Sensitive Data Exposure vulnerabilityVladimir Statsenko Terms descriptions
- CVE-2025-62141WordPress Wawp plugin <= 4.4 - Broken Access Control vulnerabilityInformation Technology Wawp
- CVE-2025-63022WordPress Simple Like Page plugin <= 1.5.3 - Broken Access Control vulnerabilitytopdevs.net Simple Like Page
- CVE-2025-63016WordPress QuadLayers TikTok Feed plugin <= 4.6.5 - Broken Access Control vulnerabilityQuadLayers TikTok Feed
- CVE-2025-62145WordPress DMCA Protection Badge plugin <= 2.2.0 - Broken Access Control vulnerabilityNewClarity DMCA Protection Badge
- CVE-2025-62147WordPress Realbig plugin <= 1.1.3 - Broken Access Control vulnerabilitynikmelnik Realbig
- CVE-2025-62081WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerabilityChannelize.io Team Live Shopping & Shoppable Videos For Woo…
- CVE-2025-63053WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerabilityLiton Arefin Master Addons for Elementor
- CVE-2025-63001WordPress Hotel Booking plugin <= 3.8 - Broken Access Control vulnerabilitynicdark Hotel Booking
- CVE-2025-49349WordPress Reuters Direct plugin <= 3.0.0 - Broken Access Control vulnerabilityReuters News Agency Reuters Direct
- CVE-2025-62098WordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerabilitytotalsoft Portfolio Gallery
- CVE-2025-62091WordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.8.2 - Broken Access Control vulnerabilityVollstart Serial Codes Generator and Validator with WooComm…
- CVE-2025-62108WordPress Add Custom Codes plugin <= 4.80 - Broken Access Control vulnerabilitySaifuMak Add Custom Codes
- CVE-2025-62888WordPress WP Attachments plugin <= 5.2 - Broken Access Control vulnerabilityMarco Milesi WP Attachments
- CVE-2025-62117WordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerabilityJayce53 EasyIndex
- CVE-2025-62120WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerabilityRick Beckman OpenHook
- CVE-2025-62134WordPress Contact Form Widget plugin <= 1.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityA WP Life Contact Form Widget
- CVE-2025-62138WordPress WP Advanced PDF plugin <= 1.1.7 - Other vulnerability Type vulnerabilitycedcommerce WP Advanced PDF
- CVE-2025-62144WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.28 - Broken Access Control vulnerabilityMohammed Kaludi Core Web Vitals & PageSpeed Booster
- CVE-2025-59003WordPress ColorWay Theme <= 4.2.3 - Sensitive Data Exposure Vulnerabilityinkthemescom ColorWay
- CVE-2025-62119WordPress Add Featured Image Custom Link plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerabilityViitorCloud Technologies Pvt Add Featured Image Custom Link
- CVE-2025-62121WordPress Logo Slider , Logo Carousel , Logo showcase , Client Logo plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerabilityImran Emu Logo Slider , Logo Carousel , Logo showcase , Cli…
- CVE-2025-62124WordPress WP Post Signature plugin <= 0.4.1 - Cross Site Scripting (XSS) vulnerabilitySoli WP Post Signature
- CVE-2025-62750WordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerabilityFilipe Seabra WooCommerce Parcelas
- CVE-2025-62140WordPress Locatoraid Store Locator plugin <= 3.9.68 - Cross Site Scripting (XSS) vulnerabilityplainware Locatoraid Store Locator
- CVE-2025-62142WordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerabilitynicashmu Post Video Players
- CVE-2025-62149WordPress Add Custom Codes plugin <= 4.80 - Cross Site Scripting (XSS) vulnerabilitySaifuMak Add Custom Codes
- CVE-2025-62095WordPress Bootstrap Modals plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityneilgee Bootstrap Modals
- CVE-2025-62096WordPress Maximum Products per User for WooCommerce plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerabilityWPFactory Maximum Products per User for WooCommerce
- CVE-2025-62097WordPress SEO Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityseothemes SEO Slider
- CVE-2025-63020WordPress Postie plugin <= 1.9.73 - Cross Site Scripting (XSS) vulnerabilityWayne Allen Postie
- CVE-2025-62111WordPress Extra Shortcodes plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilitywebvitaly Extra Shortcodes
- CVE-2025-49357WordPress Audiomack plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerabilityAudiomack
- CVE-2025-62742WordPress Curator.io plugin <= 1.9.5 - Cross Site Scripting (XSS) vulnerabilityCurator.io
- CVE-2025-62118WordPress AdWords Conversion Tracking Code plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitykcseopro AdWords Conversion Tracking Code
- CVE-2025-62990WordPress Livemesh Addons for Beaver Builder plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for Beaver Builder
- CVE-2025-62125WordPress Custom Background Changer plugin <= 3.0 - Cross Site Scripting (XSS) vulnerabilityAnshul Gangrade Custom Background Changer
- CVE-2025-62743WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerabilityzookatron MyBookTable Bookstore
- CVE-2025-62744WordPress Page Title Splitter plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerabilityChris Steman Page Title Splitter
- CVE-2025-62748WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.5 - Cross Site Scripting (XSS) vulnerabilityGenetech Products Web and WooCommerce Addons for WPBakery B…
- CVE-2025-49358WordPress Content Fetcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityRuhul Amin Content Fetcher
- CVE-2025-62749WordPress User Specific Content plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerabilityBainternet User Specific Content
- CVE-2025-62752WordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerabilityKalender.digital
- CVE-2025-62135WordPress Responsive Block Control plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerabilitylandwire Responsive Block Control
- CVE-2025-62756WordPress The Moneytizer plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerabilitylvaudore The Moneytizer
- CVE-2025-62757WordPress WebMan Amplifier plugin <= 1.5.12 - Cross Site Scripting (XSS) vulnerabilityWebMan Design | Oliver Juhas WebMan Amplifier
- CVE-2025-62991WordPress Minamaze theme <= 1.10.1 - Cross Site Scripting (XSS) vulnerabilitythinkupthemes Minamaze
- CVE-2025-63032WordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilitythinkupthemes Consulting
- CVE-2025-62136WordPress Melos theme <= 1.6.0 - Cross Site Scripting (XSS) vulnerabilitythinkupthemes Melos
- CVE-2025-62992WordPress Everest Backup plugin <= 2.3.11 - Cross Site Request Forgery (CSRF) vulnerabilityeverestthemes Everest Backup
- CVE-2025-62137WordPress Shuttle theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerabilityshuttlethemes Shuttle
- CVE-2025-62758WordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerabilityFunnelforms Free
- CVE-2025-62759WordPress Series plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerabilityJustin Tadlock Series
- CVE-2025-62760WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityBuddyDev BuddyPress Activity Shortcode
- CVE-2025-63000WordPress Sermon Manager plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerabilitywpforchurch Sermon Manager
- CVE-2025-62146WordPress MX Time Zone Clocks plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerabilityMaksym Marko MX Time Zone Clocks
- CVE-2025-63005WordPress WordPress Tooltips plugin <= 10.9.3 - Cross Site Scripting (XSS) vulnerabilityTomas WordPress Tooltips
- CVE-2025-62761WordPress Knowledge Base documentation & wiki plugin – BasePress plugin <= 2.17.0.1 - Cross Site Scripting (XSS) vulnerabilityKnowledge Base documentation & wiki plugin – BasePress
- CVE-2025-14783Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirectsmub Easy Digital Downloads – eCommerce Payments and Subscr…
- CVE-2025-14434Ultimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content DisclosureUltimate Post Kit Addons for Elementor
- CVE-2025-69277libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_poinlibsodium · pynacl +2
- CVE-2025-15375EyouCMS arcpagelist Ajax.php unserialize deserializationEyouCMS
- CVE-2025-15374EyouCMS Ask Module Ask.php cross site scriptingEyouCMS
- CVE-2025-15373EyouCMS function.php saveRemote server-side request forgeryEyouCMS
- CVE-2025-15223Philipinho Simple-PHP-Blog login.php cross site scriptingPhilipinho Simple-PHP-Blog
- CVE-2025-15372youlaitech vue3-element-admin Notice index.vue cross site scriptingyoulaitech vue3-element-admin
- CVE-2025-68131CBORDecoder reuse can leak shareable values across decode callsagronholm cbor2 · cbor2
- CVE-2025-11964OOBW in utf_16le_to_utf_8_truncated() in libpcapThe Tcpdump Group libpcap
- CVE-2025-11961OOBR and OOBW in pcap_ether_aton() in libpcapThe Tcpdump Group libpcap