# cve.now: Mojoomla

The newest entries naming Mojoomla as an affected vendor (up to 200), of 31 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2025-15657](https://cve.now/CVE-2025-15657.md): WordPress School Management plugin \<= 93.1.0 - Insecure Direct Object References (IDOR) vulnerability (CVSS 5.3)
- [CVE-2026-39433](https://cve.now/CVE-2026-39433.md): WordPress WPAMS plugin \< 49.5.3 - Arbitrary Content Deletion vulnerability (CVSS 6.5)
- [CVE-2025-15656](https://cve.now/CVE-2025-15656.md): WordPress School Management plugin \<= 93.2.0 - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-15655](https://cve.now/CVE-2025-15655.md): WordPress School Management plugin \<= 93.2.0 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2025-32303](https://cve.now/CVE-2025-32303.md): WordPress WPCHURCH plugin \<= 2.7.0 - SQL Injection Vulnerability (CVSS 9.3)
- [CVE-2025-32304](https://cve.now/CVE-2025-32304.md): WordPress WPCHURCH plugin \<= 2.7.0 - Local File Inclusion vulnerability (CVSS 8.1)
- [CVE-2025-31100](https://cve.now/CVE-2025-31100.md): WordPress School Management Plugin \<= 1.93.1 (02-07-2025) - Arbitrary File Upload Vulnerability (CVSS 9.9)
- [CVE-2025-48108](https://cve.now/CVE-2025-48108.md): WordPress School Management Plugin \<= 93.2.0 - Broken Access Control Vulnerability (CVSS 6.5)
- [CVE-2025-32574](https://cve.now/CVE-2025-32574.md): WordPress WPGYM plugin \<= 65.0 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-24774](https://cve.now/CVE-2025-24774.md): WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin \<= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-47574](https://cve.now/CVE-2025-47574.md): WordPress School Management System Plugin \<= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-24773](https://cve.now/CVE-2025-24773.md): WordPress WPCRM - CRM for Contact form CF7 & WooCommerce plugin \<= 3.2.0 - SQL Injection Vulnerability (CVSS 9.3)
- [CVE-2025-32549](https://cve.now/CVE-2025-32549.md): WordPress WPGYM \<= 65.0 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-47572](https://cve.now/CVE-2025-47572.md): WordPress School Management \<= 93.0.0 - Local File Inclusion Vulnerability (CVSS 7.5)
- [CVE-2025-47573](https://cve.now/CVE-2025-47573.md): WordPress School Management System Plugin \<= 92.0.0 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-47575](https://cve.now/CVE-2025-47575.md): WordPress School Management plugin \<= 92.0.0 - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-47613](https://cve.now/CVE-2025-47613.md): WordPress School Management System for Wordpress plugin \<= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-47631](https://cve.now/CVE-2025-47631.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-47663](https://cve.now/CVE-2025-47663.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2025-39357](https://cve.now/CVE-2025-39357.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-39380](https://cve.now/CVE-2025-39380.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Arbitrary File Upload vulnerability (CVSS 10.0)
- [CVE-2025-39386](https://cve.now/CVE-2025-39386.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-39392](https://cve.now/CVE-2025-39392.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-39393](https://cve.now/CVE-2025-39393.md): WordPress Hospital Management System plugin \<= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-39395](https://cve.now/CVE-2025-39395.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2025-39401](https://cve.now/CVE-2025-39401.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability (CVSS 10.0)
- [CVE-2025-39402](https://cve.now/CVE-2025-39402.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability (CVSS 9.9)
- [CVE-2025-39403](https://cve.now/CVE-2025-39403.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - SQL Injection vulnerability (CVSS 8.5)
- [CVE-2025-39405](https://cve.now/CVE-2025-39405.md): WordPress WPAMS plugin \<= 44.0 (17-08-2023) - Privilege Escalation vulnerability (CVSS 8.8)
- [CVE-2025-39406](https://cve.now/CVE-2025-39406.md): WordPress WPAMS plugin \<= 44.0 - Local File Inclusion to Privilege Escalation vulnerability (CVSS 9.8)
- [CVE-2025-32643](https://cve.now/CVE-2025-32643.md): WordPress WPGYM Plugin \<= 65.0 - SQL Injection vulnerability (CVSS 9.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/mojoomla
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.