2025 CVEs (page 191)
Page 191 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58206 | High | 8.1 | 2025-09-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MaxCoach maxcoach allows PHP… |
CVE-2025-57889 | High | 7.5 | 2025-09-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 InPost Gallery inpost-galle… |
CVE-2025-54744 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-53571 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-53307 | High | 7.1 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beaver Builder WordPress Assistant assistant allows Refle… |
CVE-2025-49401 | Critical | 9.8 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in axiomthemes smart SEO smartSEO allows Privilege Escalation.This issue affects smart SEO: from n/a through <= 4… |
CVE-2025-48317 | High | 7.5 | 2025-09-05 | Path Traversal: '.../...//' vulnerability in Stefan Keller WooCommerce Payment Gateway for Saferpay woocommerce-payment-gateway-for-saferpay allows Path Traver… |
CVE-2025-48105 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Boiardt Easy Flash Embed easy-flash-embed allows… |
CVE-2025-48104 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ericzane Floating Window Music Player floating-window-music-player allows Stored XSS.This issue affects Floa… |
CVE-2025-48103 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mulscully Today's Date Inserter todays-date-inserter allo… |
CVE-2025-48102 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gourl GoUrl Bitcoin Payment Gateway & Paid Downloads & Me… |
CVE-2025-32320 | High | 7.8 | 2025-09-05 | In System UI, there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of privilege with no additional… |
CVE-2025-32318 | High | 8.8 | 2025-09-05 | In Skia, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution… |
CVE-2025-32317 | Medium | 5.5 | 2025-09-05 | In App Widget, there is a possible Information Disclosure due to a confused deputy. This could lead to local information disclosure with no additional executio… |
CVE-2025-32316 | Medium | 5.5 | 2025-09-05 | In gralloc4, there is a possible out of bounds write due to a missing bounds check. This could lead to local information disclosure with no additional executio… |
CVE-2025-27003 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in fullworks Quick Paypal Payments quick-paypal-payments allows Cross Site Request Forgery.This issue affects Q… |
CVE-2025-26461 | Low | 3.3 | 2025-09-05 | In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to close the app due to a… |
CVE-2025-26434 | Medium | 5.5 | 2025-09-05 | In libxml2, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privi… |
CVE-2025-10013 | Medium | 6.3 | 2025-09-05 | A vulnerability was detected in Portabilis i-Educar up to 2.10. This affects an unknown function of the file /exportacao-para-o-seb. Performing manipulation re… |
CVE-2025-58780 | High | 7.2 | 2025-09-05 | index.em7 in ScienceLogic SL1 before 12.1.1 allows SQL Injection via a parameter in a request. NOTE: this is disputed by the Supplier because it "inaccurately… |
CVE-2025-10012 | Medium | 6.3 | 2025-09-05 | A security vulnerability has been detected in Portabilis i-Educar up to 2.10. The impacted element is an unknown function of the file educar_historico_escolar_… |
CVE-2025-8695 | Medium | 5.4 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This i… |
CVE-2025-58887 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Course Finder | andré martin - it solutions & research UG… |
CVE-2025-58886 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tan Nguyen Instant Locations instant-locations allows Sto… |
CVE-2025-58884 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ivan Drago vipdrv vipdrv-vip-test-drive allows Stored XSS… |
CVE-2025-58883 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thomas Harris Search Cloud One search-cloud-one allows St… |
CVE-2025-58882 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in w1zzard Simple Text Slider simple-text-slider allows Stor… |
CVE-2025-58881 | High | 8.5 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus New Simple Gallery new-simple-gallery allows Bli… |
CVE-2025-58880 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reubenthiessen Translate This gTranslate Shortcode transl… |
CVE-2025-58878 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in usamafarooq Woocommerce Gifts Product woo-gift-product allows Cross Site Request Forgery.This issue affects… |
CVE-2025-58876 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ali Aghdam Aparat Video Shortcode aparat-shortcode allows… |
CVE-2025-58875 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sudar Muthu WP Github Gist wp-github-gist allows Stored X… |
CVE-2025-58874 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in josepsitjar StoryMap wp-storymap allows DOM-Based XSS.Thi… |
CVE-2025-58873 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pusheco Pushe Web Push Notification pushe-webpush allows… |
CVE-2025-58872 | Medium | 6.5 | 2025-09-05 | Insertion of Sensitive Information Into Sent Data vulnerability in premiumbizthemes Simple Price Calculator simple-price-calculator-basic allows Retrieve Embed… |
CVE-2025-58871 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luis Rock Master Paper Collapse Toggle master-paper-colla… |
CVE-2025-58870 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DeBAAT WP-GraphViz wp-graphviz allows DOM-Based XSS.This… |
CVE-2025-58869 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stored XSS.This issue affects SimaCookie: from n/a thro… |
CVE-2025-58868 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simasicher SimaCookie simasicher-dsgvo-cookie allows Stor… |
CVE-2025-58867 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Remi Corson Easy Download Media Counter easy-download-med… |
CVE-2025-58866 | Low | 2.7 | 2025-09-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Rami Yushuvaev Site Info site-info-dashboard-widget allows Retrieve… |
CVE-2025-58865 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in reimund Compact Admin compact-admin allows Cross Site Request Forgery.This issue affects Compact Admin: from… |
CVE-2025-58864 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamroody 金数据 jinshuju allows Stored XSS.This issue affect… |
CVE-2025-58863 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SdeWijs Zoomify embed for WP zoom-image-shortcode allows… |
CVE-2025-58862 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in George Sexton WordPress Events Calendar Plugin – connectD… |
CVE-2025-58861 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Stored XSS.This issue affects Quick Event Calenda… |
CVE-2025-58860 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in KaizenCoders Enable Latex enable-latex allows Stored XSS.This issue affects Enable Latex: from n/a through <… |
CVE-2025-58859 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Add to Feedly add-to-feedly allows Stored XSS.This issue affects Add to Feedly: from n/a throu… |
CVE-2025-58858 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Image Widget wpb-image-widget allows Stored XS… |
CVE-2025-58857 | High | 7.1 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaizenCoders Table of content content-table allows Stored… |
CVE-2025-58856 | Medium | 6.5 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Notify Updated Product woocommerce-notify-updated-product allows Stored XSS.This issu… |
CVE-2025-58855 | High | 7.1 | 2025-09-05 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.Thi… |
CVE-2025-58854 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Samer Bechara Ultimate AJAX Login ultimate-ajax-login allows Reflected XSS.This issue affects Ultimate AJAX… |
CVE-2025-58853 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Reflected XSS.This is… |
CVE-2025-58852 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Mark O'Donnell MSTW League Manager mstw-league-manager allows Stored XSS.This issue affects MSTW League Mana… |
CVE-2025-58851 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DigitalCourt Boxed Content boxed-content allows Stored XS… |
CVE-2025-58850 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marcshowpass Showpass WordPress Extension showpass allows… |
CVE-2025-58849 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Down… |
CVE-2025-58848 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in aakash1911 WP likes wp-likes allows Reflected XSS.This issue affects WP likes: from n/a through <= 3.1.1. |
CVE-2025-58847 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a throu… |
CVE-2025-58846 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Dejan Markovic WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule… |
CVE-2025-58845 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Bulk Watermark bulk-watermark allows Reflected XSS.This issue affects Bulk Watermark: from n/a th… |
CVE-2025-58844 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: fr… |
CVE-2025-58843 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Auto Last Youtube Video auto-last-youtube-video allows Stored XSS.This issue affects Auto Last… |
CVE-2025-58842 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in givecloud Donation Forms WP by Givecloud donation-forms-b… |
CVE-2025-58841 | Medium | 5.5 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a thr… |
CVE-2025-58840 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ibnul H. Custom Team Manager custom-team-manager allows S… |
CVE-2025-58839 | High | 7.2 | 2025-09-05 | Deserialization of Untrusted Data vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Object Injection.This issue affects eD… |
CVE-2025-58838 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zakir Smooth Accordion smooth-accordion allows Stored XSS… |
CVE-2025-58837 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiful H SS Font Awesome Icon ss-font-awesome-icon allows… |
CVE-2025-58836 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franz Wieser FW Anker fw-anker allows Stored XSS.This iss… |
CVE-2025-58835 | Medium | 5.3 | 2025-09-05 | Improper Validation of Specified Quantity in Input vulnerability in calliko Bonus for Woo bonus-for-woo allows Accessing Functionality Not Properly Constrained… |
CVE-2025-58834 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gugu short.io wp-shortcm allows DOM-Based XSS.This issue… |
CVE-2025-58833 | High | 8.8 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect invelity-mygls-connect allows Object Injection.This issue affects Invelity M… |
CVE-2025-58832 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Search by Google search-google allows Stored XS… |
CVE-2025-58831 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Cross Site Request Forgery.This… |
CVE-2025-58830 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolli… |
CVE-2025-58829 | Medium | 4.9 | 2025-09-05 | Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Serv… |
CVE-2025-58828 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codemstory 코드엠샵 소셜톡 mshop-naver-talktalk allows Stored XS… |
CVE-2025-58827 | Low | 3.8 | 2025-09-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in PickPlugins Job Board Manager job-board-manager allows Code Injection.This issue aff… |
CVE-2025-58826 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Mann WP Publication Archive wp-publication-archive… |
CVE-2025-58825 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Comment Form WP – Customize Default Commen… |
CVE-2025-58824 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58823 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The African Boss Get Cash get-cash allows Stored XSS.This… |
CVE-2025-58822 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows DOM-Based XSS.This is… |
CVE-2025-58821 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever WP Notification Bell wp-notification-bell allows… |
CVE-2025-58820 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS… |
CVE-2025-58819 | Critical | 9.1 | 2025-09-05 | Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.Th… |
CVE-2025-58818 | Medium | 5.4 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in SwiftNinjaPro Developer Tools Blocker swiftninjapro-inspect-element-console-blocker allows Cross Site Reques… |
CVE-2025-58817 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects So… |
CVE-2025-58816 | Low | 3.5 | 2025-09-05 | Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Inco… |
CVE-2025-58815 | High | 7.2 | 2025-09-05 | Deserialization of Untrusted Data vulnerability in Rubel Miah Aitasi Coming Soon aitasi-coming-soon allows Object Injection.This issue affects Aitasi Coming So… |
CVE-2025-58814 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ram Ratan Maurya Stagtools stagtools allows Stored XSS.Th… |
CVE-2025-58813 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-58812 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restau… |
CVE-2025-58811 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows… |
CVE-2025-58810 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jimmywb Simple Link List Widget simple-link-list-widget a… |
CVE-2025-58809 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Nick Ciske To Lead For Salesforce salesforce-wordpress-to-lead allows Reflected XSS.This issue affects To Le… |
CVE-2025-58808 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Babar prettyPhoto prettyphoto allows Stored XSS.This issu… |
CVE-2025-58807 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Dsingh Purge Varnish Cache purge-varnish allows Stored XSS.This issue affects Purge Varnish Cache: from n/a… |