2025 CVEs (page 193)
Page 193 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58855 | High | 7.1 | 2025-09-05 | Improper Neutralization of Formula Elements in a CSV File vulnerability in Denis V (Artprima) AP HoneyPot WordPress Plugin ap-honeypot allows Reflected XSS.Thi… |
CVE-2025-58854 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Samer Bechara Ultimate AJAX Login ultimate-ajax-login allows Reflected XSS.This issue affects Ultimate AJAX… |
CVE-2025-58853 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Reflected XSS.This is… |
CVE-2025-58852 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Mark O'Donnell MSTW League Manager mstw-league-manager allows Stored XSS.This issue affects MSTW League Mana… |
CVE-2025-58851 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DigitalCourt Boxed Content boxed-content allows Stored XS… |
CVE-2025-58850 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marcshowpass Showpass WordPress Extension showpass allows… |
CVE-2025-58849 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Deepak S Hide Real Download Path hide-real-download-path allows Stored XSS.This issue affects Hide Real Down… |
CVE-2025-58848 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in aakash1911 WP likes wp-likes allows Reflected XSS.This issue affects WP likes: from n/a through <= 3.1.1. |
CVE-2025-58847 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Yaidier WN Flipbox Pro wn-flipbox-pro allows Reflected XSS.This issue affects WN Flipbox Pro: from n/a throu… |
CVE-2025-58846 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Dejan Markovic WordPress Buffer – HYPESocial. Social Media Auto Post, Social Media Auto Publish and Schedule… |
CVE-2025-58845 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Bulk Watermark bulk-watermark allows Reflected XSS.This issue affects Bulk Watermark: from n/a th… |
CVE-2025-58844 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Subhash Kumar Database to Excel database-to-excel allows Stored XSS.This issue affects Database to Excel: fr… |
CVE-2025-58843 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in David Merinas Auto Last Youtube Video auto-last-youtube-video allows Stored XSS.This issue affects Auto Last… |
CVE-2025-58842 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in givecloud Donation Forms WP by Givecloud donation-forms-b… |
CVE-2025-58841 | Medium | 5.5 | 2025-09-05 | Incorrect Privilege Assignment vulnerability in John Luetke Media Author media-author allows Privilege Escalation.This issue affects Media Author: from n/a thr… |
CVE-2025-58840 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ibnul H. Custom Team Manager custom-team-manager allows S… |
CVE-2025-58839 | High | 7.2 | 2025-09-05 | Deserialization of Untrusted Data vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Object Injection.This issue affects eD… |
CVE-2025-58838 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zakir Smooth Accordion smooth-accordion allows Stored XSS… |
CVE-2025-58837 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiful H SS Font Awesome Icon ss-font-awesome-icon allows… |
CVE-2025-58836 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Franz Wieser FW Anker fw-anker allows Stored XSS.This iss… |
CVE-2025-58835 | Medium | 5.3 | 2025-09-05 | Improper Validation of Specified Quantity in Input vulnerability in calliko Bonus for Woo bonus-for-woo allows Accessing Functionality Not Properly Constrained… |
CVE-2025-58834 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gugu short.io wp-shortcm allows DOM-Based XSS.This issue… |
CVE-2025-58833 | High | 8.8 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in INVELITY Invelity MyGLS connect invelity-mygls-connect allows Object Injection.This issue affects Invelity M… |
CVE-2025-58832 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Search by Google search-google allows Stored XS… |
CVE-2025-58831 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Cross Site Request Forgery.This… |
CVE-2025-58830 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolli… |
CVE-2025-58829 | Medium | 4.9 | 2025-09-05 | Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Serv… |
CVE-2025-58828 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codemstory 코드엠샵 소셜톡 mshop-naver-talktalk allows Stored XS… |
CVE-2025-58827 | Low | 3.8 | 2025-09-05 | Improper Control of Generation of Code ('Code Injection') vulnerability in PickPlugins Job Board Manager job-board-manager allows Code Injection.This issue aff… |
CVE-2025-58826 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Mann WP Publication Archive wp-publication-archive… |
CVE-2025-58825 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Comment Form WP – Customize Default Commen… |
CVE-2025-58824 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58823 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The African Boss Get Cash get-cash allows Stored XSS.This… |
CVE-2025-58822 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows DOM-Based XSS.This is… |
CVE-2025-58821 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever WP Notification Bell wp-notification-bell allows… |
CVE-2025-58820 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS… |
CVE-2025-58819 | Critical | 9.1 | 2025-09-05 | Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.Th… |
CVE-2025-58818 | Medium | 5.4 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in SwiftNinjaPro Developer Tools Blocker swiftninjapro-inspect-element-console-blocker allows Cross Site Reques… |
CVE-2025-58817 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects So… |
CVE-2025-58816 | Low | 3.5 | 2025-09-05 | Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Inco… |
CVE-2025-58815 | High | 7.2 | 2025-09-05 | Deserialization of Untrusted Data vulnerability in Rubel Miah Aitasi Coming Soon aitasi-coming-soon allows Object Injection.This issue affects Aitasi Coming So… |
CVE-2025-58814 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ram Ratan Maurya Stagtools stagtools allows Stored XSS.Th… |
CVE-2025-58813 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-58812 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restau… |
CVE-2025-58811 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows… |
CVE-2025-58810 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jimmywb Simple Link List Widget simple-link-list-widget a… |
CVE-2025-58809 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Nick Ciske To Lead For Salesforce salesforce-wordpress-to-lead allows Reflected XSS.This issue affects To Le… |
CVE-2025-58808 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Babar prettyPhoto prettyphoto allows Stored XSS.This issu… |
CVE-2025-58807 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Dsingh Purge Varnish Cache purge-varnish allows Stored XSS.This issue affects Purge Varnish Cache: from n/a… |
CVE-2025-58806 | High | 7.1 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Tom Longridge WordPress Error Monitoring by Bugsnag bugsnag allows Stored XSS.This issue affects WordPress E… |
CVE-2025-58805 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light all… |
CVE-2025-58804 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This is… |
CVE-2025-58802 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Si… |
CVE-2025-58801 | Medium | 5.4 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in KCS Responder responder allows Cross Site Request Forgery.This issue affects Responder: from n/a through <=… |
CVE-2025-58800 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Ema… |
CVE-2025-58799 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross… |
CVE-2025-58798 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in Bjorn Manintveld BCM Duplicate Menu bcm-duplicate-menu allows Cross Site Request Forgery.This issue affects… |
CVE-2025-58797 | Medium | 5.3 | 2025-09-05 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embed… |
CVE-2025-58796 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition ele-conditions allow… |
CVE-2025-58795 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from… |
CVE-2025-58794 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue… |
CVE-2025-58793 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows S… |
CVE-2025-58792 | Medium | 4.3 | 2025-09-05 | Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a… |
CVE-2025-58791 | Medium | 5.9 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arjan Olsder SEO Auto Linker wpa-seo-auto-linker allows S… |
CVE-2025-58790 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issu… |
CVE-2025-58789 | High | 7.6 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeisle WP Full Stripe Free wp-full-stripe-free allows… |
CVE-2025-58788 | High | 7.6 | 2025-09-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Saad Iqbal License Manager for WooCommerce license-manage… |
CVE-2025-58787 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Popup themify-popup allows Stored XSS.T… |
CVE-2025-58786 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons ibtana-ecomme… |
CVE-2025-58785 | Medium | 5.4 | 2025-09-05 | Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-58784 | Medium | 6.5 | 2025-09-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stor… |
CVE-2025-58783 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gu… |
CVE-2025-10011 | Medium | 6.3 | 2025-09-05 | A weakness has been identified in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /module/TabelaArredondamento/edit. Th… |
CVE-2025-58313 | Medium | 5.1 | 2025-09-05 | Race condition vulnerability in the device standby module. Impact: Successful exploitation of this vulnerability may cause feature exceptions of the device sta… |
CVE-2025-58296 | High | 7.5 | 2025-09-05 | Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-58281 | High | 8.4 | 2025-09-05 | Out-of-bounds read vulnerability in the runtime interpreter module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58280 | High | 8.4 | 2025-09-05 | Vulnerability of exposing object heap addresses in the Ark eTS module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58276 | Medium | 6.8 | 2025-09-05 | Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-48395 | Medium | 4.7 | 2025-09-05 | An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI… |
CVE-2025-8944 | Medium | 4.3 | 2025-09-05 | The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any a… |
CVE-2025-58400 | Medium | 6.7 | 2025-09-05 | RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted file path. A user with the write permiss… |
CVE-2025-55671 | High | 7.8 | 2025-09-05 | Uncontrolled search path element issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnerability is exploited, arbitrary code may be executed with t… |
CVE-2025-55037 | Critical | 9.8 | 2025-09-05 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If this vulnera… |
CVE-2025-41408 | Medium | 4.3 | 2025-09-05 | Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated at… |
CVE-2025-58401 | Medium | 6.8 | 2025-09-05 | Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attacker may perform unauthorized operations o… |
CVE-2025-8684 | Medium | 6.4 | 2025-09-05 | The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to in… |
CVE-2025-9990 | High | 8.1 | 2025-09-05 | The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type… |
CVE-2025-7445 | Medium | 6.5 | 2025-09-05 | Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs. |
CVE-2025-58362 | High | 7.5 | 2025-09-05 | Hono is a Web application framework that provides support for any JavaScript runtime. Versions 4.8.0 through 4.9.5 contain a flaw in the getPath utility functi… |
CVE-2025-58359 | | 2025-09-05 | ZF FROST is a Rust implementation of FROST (Flexible Round-Optimised Schnorr Threshold signatures). In versions 2.0.0 through 2.1.0, refresh shares with smalle… | |
CVE-2025-58352 | Medium | 6.5 | 2025-09-05 | Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verifica… |
CVE-2025-58179 | High | 7.2 | 2025-09-05 | Astro is a web framework for content-driven websites. Versions 11.0.3 through 12.6.5 are vulnerable to SSRF when using Astro's Cloudflare adapter. When configu… |
CVE-2025-55739 | | 2025-09-05 | api is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions lower than 15.0.13, 16.0.2 through 16.0.14, 17… | |
CVE-2025-55305 | Medium | 6.1 | 2025-09-04 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions below 35.7.5, 36.0.0-alpha.1 through 36.8.0… |
CVE-2025-55244 | Critical | 9.0 | 2025-09-04 | Azure Bot Service Elevation of Privilege Vulnerability |
CVE-2025-55242 | Medium | 6.5 | 2025-09-04 | Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network. |
CVE-2025-55241 | Critical | 10.0 | 2025-09-04 | Azure Entra ID Elevation of Privilege Vulnerability |
CVE-2025-55238 | High | 7.5 | 2025-09-04 | Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability |
CVE-2025-55209 | | 2025-09-04 | contactmanager is a module for FreePBX@, which is an open source GUI that controls and manages Asterisk© (PBX). In versions 15.0.14 and below, 16.0.0 through 1… | |
CVE-2025-55190 | Critical | 9.9 | 2025-09-04 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2.14.0 through 2.14.15, 3.0.0 through 3.0.12 and 3… |