2025 CVEs (page 202)
Page 202 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48363 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issu… |
CVE-2025-48362 | Medium | 5.4 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affec… |
CVE-2025-48361 | Medium | 5.3 | 2025-08-28 | Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Retrieve Embedded Sensitive… |
CVE-2025-48360 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows… |
CVE-2025-48359 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a… |
CVE-2025-48358 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommer… |
CVE-2025-48357 | Medium | 5.4 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Theme Century Century ToolKit century-toolkit allows Cross Site Request Forgery.This issue affects Century T… |
CVE-2025-48356 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affec… |
CVE-2025-48354 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Element… |
CVE-2025-48353 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts allows Stored XSS.This issu… |
CVE-2025-48352 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger yandex-pinger… |
CVE-2025-48351 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Scree… |
CVE-2025-48350 | Medium | 4.3 | 2025-08-28 | Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-48349 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smar… |
CVE-2025-48348 | Medium | 4.3 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline site-offline allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-48347 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bx… |
CVE-2025-48343 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authenticatio… |
CVE-2025-48327 | Medium | 5.3 | 2025-08-28 | Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-48325 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a throug… |
CVE-2025-48324 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-… |
CVE-2025-48323 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allo… |
CVE-2025-48322 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XS… |
CVE-2025-48321 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects… |
CVE-2025-48320 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 baidushare-wp allows Stored XSS.This issue affects 百度分享按钮: from n/a through <= 1.0.6. |
CVE-2025-48319 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reser… |
CVE-2025-48318 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 duoshuo allows Cross Site Request Forgery.This issue affects 多说社会化评论框: from n/a through <= 1… |
CVE-2025-48316 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobi… |
CVE-2025-48315 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Sto… |
CVE-2025-48314 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored… |
CVE-2025-48313 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode tripadvisor-shortcode a… |
CVE-2025-48312 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Sto… |
CVE-2025-48311 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a thr… |
CVE-2025-48310 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor wp-table-editor allows Cross Site Request Forgery.This issue affects Table Editor… |
CVE-2025-48309 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through <= 1.0.1 Lite. |
CVE-2025-48308 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored… |
CVE-2025-48307 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a throug… |
CVE-2025-48306 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects… |
CVE-2025-48305 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreo… |
CVE-2025-48304 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML Ne… |
CVE-2025-48110 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue… |
CVE-2025-48109 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through <= 0.9.1. |
CVE-2025-48100 | Critical | 9.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inc… |
CVE-2025-9376 | Medium | 6.5 | 2025-08-28 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an… |
CVE-2025-39496 | Critical | 9.3 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This… |
CVE-2025-55175 | Medium | 6.1 | 2025-08-28 | QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, wh… |
CVE-2025-54544 | Medium | 4.8 | 2025-08-28 | QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject arb… |
CVE-2025-54543 | Medium | 4.8 | 2025-08-28 | QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbit… |
CVE-2025-54542 | Medium | 5.5 | 2025-08-28 | QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials… |
CVE-2025-54541 | Medium | 4.3 | 2025-08-28 | QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the ad… |
CVE-2025-54540 | Medium | 6.1 | 2025-08-28 | QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when o… |
CVE-2025-48963 | High | 7.3 | 2025-08-28 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2025-58081 | High | 7.5 | 2025-08-28 | Use of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to… |
CVE-2025-58072 | High | 7.5 | 2025-08-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier… |
CVE-2025-54819 | Medium | 6.5 | 2025-08-28 | Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier… |
CVE-2025-54762 | Critical | 9.8 | 2025-08-28 | SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands wi… |
CVE-2025-53970 | Critical | 9.8 | 2025-08-28 | SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to upload arbitrary files and execute OS commands wi… |
CVE-2025-53396 | High | 7.0 | 2025-08-28 | Incorrect permission assignment for critical resource issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier), which may allow users… |
CVE-2025-52460 | Medium | 5.3 | 2025-08-28 | Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If exploited, uploaded f… |
CVE-2025-46409 | High | 7.5 | 2025-08-28 | Inadequate encryption strength issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier). If this vulnerability is exploited, a functio… |
CVE-2025-58322 | High | 7.8 | 2025-08-28 | NAVER MYBOX Explorer for Windows before 3.0.8.133 allows a local attacker to escalate privileges to NT AUTHORITY\SYSTEM by invoking arbitrary DLLs due to impro… |
CVE-2025-8073 | Medium | 6.4 | 2025-08-28 | The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up… |
CVE-2025-6255 | Medium | 6.4 | 2025-08-28 | The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all version… |
CVE-2025-7956 | Medium | 5.3 | 2025-08-28 | The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions u… |
CVE-2025-7955 | Critical | 9.8 | 2025-08-28 | The RingCentral Communications plugin for WordPress is vulnerable to Authentication Bypass due to improper validation within the ringcentral_admin_login_2fa_ve… |
CVE-2025-8977 | Medium | 6.5 | 2025-08-28 | The Simple Download Monitor plugin for WordPress is vulnerable to time-based SQL Injection via the order parameter in all versions up to, and including, 3.9.33… |
CVE-2025-9346 | Medium | 6.4 | 2025-08-28 | The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insuff… |
CVE-2025-9345 | Medium | 4.9 | 2025-08-28 | The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the… |
CVE-2025-8603 | Medium | 6.4 | 2025-08-28 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including… |
CVE-2025-0951 | Medium | 4.3 | 2025-08-28 | Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpr… |
CVE-2025-9352 | Medium | 5.4 | 2025-08-28 | The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4… |
CVE-2025-9344 | Medium | 6.4 | 2025-08-28 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site S… |
CVE-2025-8897 | Medium | 6.1 | 2025-08-28 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' parameter in all version… |
CVE-2025-7812 | High | 8.8 | 2025-08-28 | The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-36003 | High | 7.5 | 2025-08-28 | IBM Security Verify Governance Identity Manager 10.0.2 could allow a remote attacker to obtain sensitive information when detailed technical error messages are… |
CVE-2025-34523 | Critical | 9.8 | 2025-08-27 | A heap-based buffer overflow vulnerability exists in the network-facing input handling routines of Arcserve Unified Data Protection (UDP). This flaw is reachab… |
CVE-2025-34522 | Critical | 9.8 | 2025-08-27 | A heap-based buffer overflow vulnerability exists in the input parsing logic of Arcserve Unified Data Protection (UDP). This flaw can be triggered without auth… |
CVE-2025-34521 | Medium | 5.4 | 2025-08-27 | A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the Arcserve Unified Data Protection (UDP), where unsanitized user input is… |
CVE-2025-34520 | Critical | 9.8 | 2025-08-27 | An authentication bypass vulnerability in Arcserve Unified Data Protection (UDP) allows unauthenticated attackers to gain unauthorized access to protected func… |
CVE-2025-34163 | | 2025-08-27 | Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access… | |
CVE-2025-34162 | | 2025-08-27 | An unauthenticated SQL injection vulnerability exists in the GetLyfsByParams endpoint of Bian Que Feijiu Intelligent Emergency and Quality Control System, acce… | |
CVE-2025-34160 | | 2025-08-27 | AnyShare contains a critical unauthenticated remote code execution vulnerability in the ServiceAgent API exposed on port 10250. The endpoint /api/ServiceAgent/… | |
CVE-2025-40779 | High | 7.5 | 2025-08-27 | If a DHCPv4 client sends a request with some specific options, and Kea fails to find an appropriate subnet for the client, the `kea-dhcp4` process will abort w… |
CVE-2025-5101 | Medium | 5.0 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that under certain conditions cou… |
CVE-2025-55618 | High | 7.3 | 2025-08-27 | In Hyundai Navigation App STD5W.EUR.HMC.230516.afa908d, an attacker can inject HTML payloads in the profile name field in navigation app which then get rendere… |
CVE-2025-55582 | Medium | 6.6 | 2025-08-27 | D-Link DCS-825L firmware v1.08.01 contains a vulnerability in the watchdog script `mydlink-watch-dog.sh`, which blindly respawns binaries such as `dcp` and `si… |
CVE-2025-4225 | Medium | 5.3 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.1 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that that under certain… |
CVE-2025-3601 | Medium | 6.5 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.15 before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have could h… |
CVE-2025-2246 | Medium | 5.8 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthent… |
CVE-2025-58050 | Critical | 9.1 | 2025-08-27 | The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exist… |
CVE-2025-55495 | Medium | 6.5 | 2025-08-27 | Tenda AC6 V15.03.06.23_multi was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function. |
CVE-2025-58218 | High | 7.2 | 2025-08-27 | Deserialization of Untrusted Data vulnerability in enituretechnology Small Package Quotes – USPS Edition small-package-quotes-usps-edition allows Object Inject… |
CVE-2025-58217 | High | 7.1 | 2025-08-27 | Cross-Site Request Forgery (CSRF) vulnerability in GeroNikolov Instant Breaking News instant-breaking-news allows Stored XSS.This issue affects Instant Breakin… |
CVE-2025-58216 | Medium | 5.9 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jgwhite33 WP Thumbtack Review Slider wp-thumbtack-review-… |
CVE-2025-58213 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ameliabooking Booking System Trafft booking-system-trafft… |
CVE-2025-58212 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in epeken Epeken All Kurir epeken-all-kurir allows DOM-Based… |
CVE-2025-58211 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Stored… |
CVE-2025-58209 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtCamp Transcoder transcoder allows Stored XSS.This issue… |
CVE-2025-58208 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Templ… |
CVE-2025-58205 | Medium | 6.5 | 2025-08-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor eleme… |
CVE-2025-58204 | Medium | 4.7 | 2025-08-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Eric Teubert Podlove Podcast Publisher podlove-podcasting-plugin-for-wordpress allows Phis… |