2025 CVEs (page 173)
Page 173 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58219 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in LIJE Show Pages List show-pages-list allows Cross Site Request Forgery.This issue affects Show Pages List: f… |
CVE-2025-58200 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in Bage Flexible FAQ flexible-faq allows Cross Site Request Forgery.This issue affects Flexible FAQ: from n/a t… |
CVE-2025-58199 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in Fastly Fastly fastly allows Cross Site Request Forgery.This issue affects Fastly: from n/a through <= 1.2.28. |
CVE-2025-58033 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leeshadle Draft website-builder allows Stored XSS.This is… |
CVE-2025-58032 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in Bytes.co WP Compiler wp-compiler allows Cross Site Request Forgery.This issue affects WP Compiler: from n/a… |
CVE-2025-58031 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-con… |
CVE-2025-58030 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issu… |
CVE-2025-58029 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functiona… |
CVE-2025-58028 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aum Watcharapon Designil PDPA Thailand pdpa-thailand allo… |
CVE-2025-58027 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allo… |
CVE-2025-58026 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in termageddon Termageddon: Cookie Consent & Privacy Complia… |
CVE-2025-58025 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider master-slider allows Stored XSS.This… |
CVE-2025-58023 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in akdevs Genealogical Tree genealogical-tree allows Stored… |
CVE-2025-58022 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxpagels ShortCode shortcode allows Stored XSS.This issu… |
CVE-2025-58021 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr List Child Pages Shortcode list-child-pages-s… |
CVE-2025-58020 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored… |
CVE-2025-58019 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Store… |
CVE-2025-58018 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman Mail Subscribe List mail-subscribe-list… |
CVE-2025-58017 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-sto… |
CVE-2025-58016 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-58015 | Medium | 5.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Da… |
CVE-2025-58014 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a thro… |
CVE-2025-58013 | High | 8.8 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 4.5… |
CVE-2025-58012 | Low | 3.8 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-58011 | Medium | 6.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a… |
CVE-2025-58010 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in straightvisions GmbH SV Proven Expert sv-provenexpert allows Cross Site Request Forgery.This issue affects S… |
CVE-2025-58009 | Low | 3.8 | 2025-09-22 | Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-58008 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-databas… |
CVE-2025-58007 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive… |
CVE-2025-58006 | Medium | 4.7 | 2025-09-22 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue af… |
CVE-2025-58005 | Medium | 5.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: fr… |
CVE-2025-58004 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58003 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-58002 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD bbPress Tools gd-bbpress-tools allows D… |
CVE-2025-58001 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stor… |
CVE-2025-58000 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2025-57999 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpkoithemes WPKoi Templates for Elementor wpkoi-templates… |
CVE-2025-57998 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hamid Reza Yazdani E-namad & Shamed Logo Manager e-namad-… |
CVE-2025-57997 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Trustpilot Trustpilot Reviews trustpilot-reviews allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-57996 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthewordie Buckets buckets allows Stored XSS.This issue… |
CVE-2025-57995 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-57994 | Medium | 5.4 | 2025-09-22 | Authorization Bypass Through User-Controlled Key vulnerability in Sayful Islam Upcoming Events Lists upcoming-events-lists allows Exploiting Incorrectly Config… |
CVE-2025-57993 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Pick Geolocation IP Detection geoip-detect allow… |
CVE-2025-57992 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in InterServer Mail Baby SMTP mail-baby-smtp allows Cross Site Request Forgery.This issue affects Mail Baby SMT… |
CVE-2025-57991 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in Clariti Clariti clariti allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clari… |
CVE-2025-57990 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in solwininfotech Blog Designer blog-designer allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-57989 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brajesh Singh WordPress Widgets Shortcode wp-widgets-shor… |
CVE-2025-57988 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learnda… |
CVE-2025-57987 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in ThimPress WP Events Manager wp-events-manager allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-57986 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in husani WP Subtitle wp-subtitle allows Stored XSS.This iss… |
CVE-2025-57985 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-57984 | Medium | 4.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Pratik Ghela MakeStories (for Google Web Stories) makestories-helper allows Server Side Request Forgery.Thi… |
CVE-2025-57983 | Medium | 6.5 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in Damian BP Disable Activation Reloaded bp-disable-activation-reloaded allows Accessing Functionality Not Prop… |
CVE-2025-57982 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean Advance Portfolio Grid advance-portfolio-grid allo… |
CVE-2025-57981 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stor… |
CVE-2025-57980 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas Cordero Safety Exit safety-exit allows Stored XSS.T… |
CVE-2025-57979 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson AuthorSure authorsure allows Stored XSS… |
CVE-2025-57978 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in themespride Advanced Appointment Booking & Scheduling advanced-appointment-booking-scheduling allows Cross S… |
CVE-2025-57977 | High | 7.1 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible PDF Invoices for WooCommerce & WordPress flexible-invoices allows Cross Site Request Forgery… |
CVE-2025-57976 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in CardCom CardCom Payment Gateway woo-cardcom-payment-gateway allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-57975 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tea… |
CVE-2025-57974 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Stored XSS… |
CVE-2025-57973 | Medium | 5.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This… |
CVE-2025-57972 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorre… |
CVE-2025-57971 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-57970 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Cross Site Request Forgery.This issue affects SALESmanag… |
CVE-2025-57969 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Jeremy Saxey Hide WP Toolbar hide-wp-toolbar allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-57968 | High | 7.1 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Reflected X… |
CVE-2025-57967 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Quick View for WooCommerce woocommerce-lightbo… |
CVE-2025-57966 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-lightbox-slider allows… |
CVE-2025-57965 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs WP Proposals allows Stored XSS. This issue affe… |
CVE-2025-57964 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in photonicgnostic Library Bookshelves library-bookshelves a… |
CVE-2025-57963 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoho Subscriptions Zoho Billing zoho-subscriptions allows… |
CVE-2025-57962 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRestaurants vikrestaurants allows Stored XSS… |
CVE-2025-57961 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Codexpert, Inc CoDesigner woolementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-57960 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in TravelMap Travel Map travelmap-blog allows Cross Site Request Forgery.This issue affects Travel Map: from n/… |
CVE-2025-57959 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tmatsuur Slightly troublesome permalink slightly-troubles… |
CVE-2025-57957 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in wpcraft WooMS wooms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooMS: fr… |
CVE-2025-57956 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Stored XSS.This issue affects… |
CVE-2025-57955 | Medium | 6.5 | 2025-09-22 | Missing Authorization vulnerability in Plugin Devs Post Carousel Slider for Elementor post-carousel-slider-for-elementor allows Exploiting Incorrectly Configur… |
CVE-2025-57954 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Poll Maker poll-maker allows DOM-Based XSS.This i… |
CVE-2025-57953 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based X… |
CVE-2025-57952 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icopydoc Maps for WP maps-for-wp allows Stored XSS.This i… |
CVE-2025-57951 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ken107 SiteNarrator Text-to-Speech Widget sitespeaker-wid… |
CVE-2025-57950 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Glen Scott Plugin Security Scanner plugin-security-scanne… |
CVE-2025-57949 | Medium | 5.4 | 2025-09-22 | Missing Authorization vulnerability in oggix Ongkoskirim.id ongkoskirim-id allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-57948 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Directory Pro directory-pro allows DOM-Based XS… |
CVE-2025-57947 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Photo Gallery by Ays gallery-photo-gallery allows… |
CVE-2025-57946 | Medium | 5.4 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in Loc Bui payOS payos allows Cross Site Request Forgery.This issue affects payOS: from n/a through <= 1.0.73. |
CVE-2025-57945 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Stored… |
CVE-2025-57944 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Accessing Functionality Not Properly Constrained by ACLs.T… |
CVE-2025-57943 | Medium | 4.4 | 2025-09-22 | Server-Side Request Forgery (SSRF) vulnerability in Skimlinks Skimlinks Affiliate Marketing Tool skimlinks allows Server Side Request Forgery.This issue affect… |
CVE-2025-57942 | Medium | 4.3 | 2025-09-22 | Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Emergency Password Reset emergency-password-reset allows Cross Site Request Forgery.This issue af… |
CVE-2025-57941 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JonathanMH Append Link on Copy append-link-on-copy allows… |
CVE-2025-57940 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suresh Kumar Mukhiya Append extensions on Pages append-ex… |
CVE-2025-57939 | Medium | 5.3 | 2025-09-22 | Missing Authorization vulnerability in Blocksera Image Hover Effects – Elementor Addon image-hover-effects-addon-for-elementor allows Exploiting Incorrectly Co… |
CVE-2025-57938 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themewant Easy Hotel Booking easy-hotel allows DOM-Based… |
CVE-2025-57937 | Medium | 4.3 | 2025-09-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in etruel WPeMatico RSS Feed Fetcher wpematico allows Retrieve Embedde… |
CVE-2025-57936 | Medium | 4.3 | 2025-09-22 | Missing Authorization vulnerability in Meitar Subresource Integrity (SRI) Manager wp-sri allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-57935 | Medium | 5.9 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ricky Dawn Bot Block – Stop Spam Referrals in Google Anal… |