2025 CVEs (page 102)
Page 102 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30201 | High | 7.7 | 2025-11-21 | Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows au… |
CVE-2025-29934 | Medium | 5.3 | 2025-11-21 | A bug within some AMD CPUs could allow a local admin-privileged attacker to run a SEV-SNP guest using stale TLB entries, potentially resulting in loss of data… |
CVE-2025-64483 | | 2025-11-21 | Wazuh is a security detection, visibility, and compliance open source project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in cert… | |
CVE-2025-13132 | High | 7.4 | 2025-11-21 | This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, use… |
CVE-2025-13470 | High | 7.5 | 2025-11-21 | In RNP version 0.18.0 a refactoring regression causes the symmetric session key used for Public-Key Encrypted Session Key (PKESK) packets to be left uninitia… |
CVE-2025-12973 | High | 7.2 | 2025-11-21 | The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file typ… |
CVE-2025-12747 | Medium | 5.3 | 2025-11-21 | The Tainacan plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.0.0 via uploaded files marked as private being… |
CVE-2025-41115 | Critical | 10.0 | 2025-11-21 | SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing… |
CVE-2025-13432 | Medium | 4.3 | 2025-11-21 | Terraform state versions can be created by a user with specific but insufficient permissions in a Terraform Enterprise workspace. This may allow for the altera… |
CVE-2025-13357 | High | 7.4 | 2025-11-21 | Vault’s Terraform Provider incorrectly set the default deny_null_bind parameter for the LDAP auth method to false by default, potentially resulting in an insec… |
CVE-2025-11127 | Critical | 9.8 | 2025-11-21 | The Mstoreapp Mobile App WordPress plugin through 2.08 and Mstoreapp Mobile Multivendor through 9.0.1 do not properly verify users identify when using an AJAX… |
CVE-2025-66115 | Medium | 6.6 | 2025-11-21 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MatrixAddons Easy Invoice easy-invoice… |
CVE-2025-66114 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in theme funda Show Variations as Single Products Woocommerce woo-show-single-variations-shop-category allows Exploiting In… |
CVE-2025-66113 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Better Chat Support for Messenger better-chat-support allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-66112 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Accessibility Toolkit by WebYes accessibility-plus allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-66111 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XS… |
CVE-2025-66110 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-66109 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Octolize Shipping Plugins Cart Weight for WooCommerce woo-cart-weight allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-66108 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Merlot Digital (by TNC) TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66107 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Scott Paterson Subscriptions & Memberships for PayPal subscriptions-memberships-for-paypal allows Exploiting Incorrectly… |
CVE-2025-66106 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Essential Plugin Featured Post Creative featured-post-creative allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-66101 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Sabuj Kundu CBX Bookmark & Favorite cbxwpbookmark allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66099 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in ThemeAtelier Chat Help chat-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-66098 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS… |
CVE-2025-66097 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Term… |
CVE-2025-66096 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Imtiaz Rayhan Table Block by Tableberg tableberg allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66095 | High | 8.5 | 2025-11-21 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system… |
CVE-2025-66093 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions for Leaflet Map extensions-leaflet-map… |
CVE-2025-66092 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bqworks Accordion Slider accordion-slider allows Stored X… |
CVE-2025-66091 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Design Stylish Cost Calculator stylish-cost-calculator al… |
CVE-2025-66090 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows DOM-Based… |
CVE-2025-66089 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-66087 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-66086 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66085 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-66084 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66083 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66082 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in magepeopleteam WpEvently mage-eventpress allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-66081 | Medium | 5.9 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Head Meta Data head-meta-data allows Stored XS… |
CVE-2025-66079 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-66077 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-66075 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-66073 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through… |
CVE-2025-66072 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Users… |
CVE-2025-66071 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly C… |
CVE-2025-66069 | Medium | 4.3 | 2025-11-21 | Missing Authorization vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-66067 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows DO… |
CVE-2025-66066 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This i… |
CVE-2025-66065 | Medium | 6.5 | 2025-11-21 | Missing Authorization vulnerability in Jegstudio Gutenverse gutenverse allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-66064 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue a… |
CVE-2025-66063 | Medium | 5.4 | 2025-11-21 | Missing Authorization vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-66062 | Low | 3.4 | 2025-11-21 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Frank Goossens WP YouTube Lyte wp-youtube-lyte allows Phishing.This issue affects WP YouTu… |
CVE-2025-66061 | Medium | 4.3 | 2025-11-21 | Cross-Site Request Forgery (CSRF) vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Cross Site Request Forgery.This… |
CVE-2025-66060 | Medium | 5.3 | 2025-11-21 | Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-66059 | Medium | 5.3 | 2025-11-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcastin… |
CVE-2025-66057 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows DOM… |
CVE-2025-66056 | Medium | 4.3 | 2025-11-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Retrieve Emb… |
CVE-2025-66055 | High | 7.2 | 2025-11-21 | Deserialization of Untrusted Data vulnerability in Icegram Email Subscribers & Newsletters email-subscribers allows Object Injection.This issue affects Email S… |
CVE-2025-66053 | Medium | 6.5 | 2025-11-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold enfold allows Stored XSS.This issue affects… |
CVE-2025-12935 | Medium | 6.4 | 2025-11-21 | The FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to Stored Cr… |
CVE-2025-10054 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability che… |
CVE-2025-10039 | Medium | 4.3 | 2025-11-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2025-40211 | | 2025-11-21 | In the Linux kernel, the following vulnerability has been resolved: ACPI: video: Fix use-after-free in acpi_video_switch_brightness() The switch_brightness_w… | |
CVE-2025-40210 | High | 7.5 | 2025-11-21 | In the Linux kernel, the following vulnerability has been resolved: Revert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND" I've found that… |
CVE-2025-40209 | | 2025-11-21 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relation When btrfs_add_qgroup_… | |
CVE-2025-13138 | High | 7.5 | 2025-11-21 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'columns_search' parameter of the select_2_ajax() function in all versions up… |
CVE-2025-12964 | Medium | 6.4 | 2025-11-21 | The Magical Products Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpdpr_title_tag' and 'mpdpr_subtitle_tag' parameters in… |
CVE-2025-12750 | Medium | 4.9 | 2025-11-21 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to SQL Injection via the 'term' parameter in all versions up to… |
CVE-2025-12160 | High | 7.2 | 2025-11-21 | The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and inc… |
CVE-2025-12066 | Medium | 4.4 | 2025-11-21 | The WP Delete Post Copies plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 6.0.2 due… |
CVE-2025-13156 | High | 8.8 | 2025-11-21 | The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the inser… |
CVE-2025-13149 | Medium | 4.3 | 2025-11-21 | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthoriz… |
CVE-2025-13141 | Medium | 6.4 | 2025-11-21 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gutenberg blocks in all versions… |
CVE-2025-12039 | Medium | 5.3 | 2025-11-21 | The BigBuy Dropshipping Connector for WooCommerce plugin for WordPress is vulnerable to IP Address Spoofing in all versions up to, and including, 2.0.5 due to… |
CVE-2025-11973 | Medium | 4.9 | 2025-11-21 | The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports f… |
CVE-2025-11826 | Medium | 6.4 | 2025-11-21 | The WP Company Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' attribute of the 'social-networks' shortcode in all versi… |
CVE-2025-11808 | Medium | 6.4 | 2025-11-21 | The Shortcode for Google Street View plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'streetview' shortcode in all versions up to, an… |
CVE-2025-11803 | Medium | 6.4 | 2025-11-21 | The WPSite Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'format' shortcode attribute in the wpsite_y shortcode and the '… |
CVE-2025-13322 | High | 8.1 | 2025-11-21 | The WP AUDIO GALLERY plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in all versions up to, and includin… |
CVE-2025-13159 | High | 7.1 | 2025-11-21 | The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and… |
CVE-2025-13142 | Medium | 4.3 | 2025-11-21 | The Custom Post Type plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing nonce v… |
CVE-2025-13135 | Medium | 6.4 | 2025-11-21 | The HotelRunner Booking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'hotelrunner' shortcode in all versions up to… |
CVE-2025-13134 | Medium | 6.1 | 2025-11-21 | The AuthorSure plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.3. This is due to missing or incorrect… |
CVE-2025-12894 | Medium | 5.3 | 2025-11-21 | The Import WP – Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, an… |
CVE-2025-12881 | Medium | 5.4 | 2025-11-21 | The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5… |
CVE-2025-12746 | Medium | 6.1 | 2025-11-21 | The Tainacan plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 1.0.0 due to… |
CVE-2025-12661 | Medium | 6.4 | 2025-11-21 | The Pollcaster Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'height' parameter in the 'pollcaster' shortcode in all vers… |
CVE-2025-12660 | Medium | 6.4 | 2025-11-21 | The Padlet Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'key' parameter in the 'wallwisher' shortcode in all versions up… |
CVE-2025-12170 | Medium | 5.3 | 2025-11-21 | The Checkbox plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'wp_ajax_nopriv_checkbox_clean_log' AJAX… |
CVE-2025-12138 | High | 8.8 | 2025-11-21 | The URL Image Importer plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and includi… |
CVE-2025-12135 | High | 7.2 | 2025-11-21 | The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css_code' parameter in all versions up to, and including, 1.0.6 due to… |
CVE-2025-12086 | Medium | 4.3 | 2025-11-21 | The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5… |
CVE-2025-11985 | High | 8.8 | 2025-11-21 | The Realty Portal plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability che… |
CVE-2025-11885 | Medium | 6.1 | 2025-11-21 | The EchBay Admin Security plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '_ebnonce' parameter in all versions up to, and includin… |
CVE-2025-11815 | Medium | 4.3 | 2025-11-21 | The UiPress lite | Effortless custom dashboards, admin themes and pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missin… |
CVE-2025-11802 | Medium | 6.4 | 2025-11-21 | The Bulma Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' shortcode attribute in the bulma-notification shortcode i… |
CVE-2025-11801 | Medium | 6.4 | 2025-11-21 | The AudioTube plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' shortcode attribute of the 'audiotube' shortcode in all versi… |
CVE-2025-11800 | Medium | 6.4 | 2025-11-21 | The Surbma | MiniCRM Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute of the 'minicrm' shortcode in… |
CVE-2025-11799 | Medium | 6.4 | 2025-11-21 | The Affiliate AI Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'asin' shortcode attribute in the affiai_img shortcode in all v… |
CVE-2025-11773 | Medium | 4.3 | 2025-11-21 | The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthorized modification of data due to… |