2025 CVEs (page 203)
Page 203 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58123 | Medium | 4.8 | 2025-08-28 | Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic. |
CVE-2025-54742 | High | 8.8 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2025-54738 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in NooTheme Jobmonster noo-jobmonster allows Authentication Abuse.This issue affects Job… |
CVE-2025-54734 | Medium | 5.8 | 2025-08-28 | Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B… |
CVE-2025-54733 | Medium | 6.5 | 2025-08-28 | Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-54731 | High | 8.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in emarket-design YouTube Showcase youtube-showcase allows Object Injection.This issue… |
CVE-2025-54725 | Critical | 9.8 | 2025-08-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in uxper Golo golo allows Authentication Abuse.This issue affects Golo: from n/a through… |
CVE-2025-54724 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects G… |
CVE-2025-54720 | Critical | 9.3 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SteelThemes Nest Addons nest-addons allows SQL Injection… |
CVE-2025-54716 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ireca ireca allows PHP Local… |
CVE-2025-54714 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-54710 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ti… |
CVE-2025-54029 | High | 7.7 | 2025-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in extendons WooCommerce csv import export extendons-eo-wooimport-… |
CVE-2025-53588 | High | 7.7 | 2025-08-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator u… |
CVE-2025-53584 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Ticket Customer Service Software & Support Ticket System wp-ticket allows Object Injection… |
CVE-2025-53583 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Spotlight employee-spotlight allows Object Injection.This issue affects Employee Spo… |
CVE-2025-53579 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in captcha.eu Captcha.eu captcha-eu allows Reflected XSS.Thi… |
CVE-2025-53578 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Kipso kipso allows PHP Local Fi… |
CVE-2025-53576 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Ovatheme Events ova-events al… |
CVE-2025-53572 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design WP Easy Contact wp-easy-contact allows Object Injection.This issue affects WP Easy Contact: f… |
CVE-2025-53337 | Medium | 5.4 | 2025-08-28 | Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-53334 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TieLabs Jannah jannah allows PHP Local… |
CVE-2025-53328 | High | 7.5 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Opinion Stage Poll, Survey & Quiz Make… |
CVE-2025-53326 | High | 7.5 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodeYatri Gutenify gutenify allows PHP… |
CVE-2025-53289 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Widget Areas theme-blvd-widget-areas all… |
CVE-2025-53250 | Medium | 6.4 | 2025-08-28 | Server-Side Request Forgery (SSRF) vulnerability in Chartbeat Chartbeat chartbeat allows Server Side Request Forgery.This issue affects Chartbeat: from n/a thr… |
CVE-2025-53248 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine eximious-magazine al… |
CVE-2025-53247 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpinterface BlogMarks blogmarks allows… |
CVE-2025-53244 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Elite magazine-elite… |
CVE-2025-53243 | High | 8.1 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress employee-directory a… |
CVE-2025-53230 | High | 7.6 | 2025-08-28 | Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-53227 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magazine Saga magazine-saga a… |
CVE-2025-53225 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eboekhouden e-Boekhouden.nl e-boekhoudennl-connector allo… |
CVE-2025-53224 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Koen Schuit NextGEN Gallery Search nextgen-gallery-search… |
CVE-2025-53223 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undoIT Theme Switcher Reloaded theme-switcher-reloaded al… |
CVE-2025-53220 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in XmasB XmasB Quotes xmasb-quotes allows Reflected XSS.This… |
CVE-2025-53216 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themeuniver Glamer glamer allows PHP L… |
CVE-2025-53215 | High | 7.1 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8bitkid Yahoo! WebPlayer yahoo-media-player allows Reflec… |
CVE-2025-52761 | Critical | 9.8 | 2025-08-28 | Deserialization of Untrusted Data vulnerability in manfcarlo WP Funnel Manager wp-funnel-manager allows Object Injection.This issue affects WP Funnel Manager… |
CVE-2025-49407 | High | 8.8 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez allows Reflected XSS. This issue affect… |
CVE-2025-49405 | Medium | 4.3 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local Fil… |
CVE-2025-49404 | High | 8.5 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in purethemes Listeo Core listeo-core allows SQL Injection.T… |
CVE-2025-49402 | High | 8.5 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in scriptsbundle Exertio Framework exertio-framework allows… |
CVE-2025-49388 | Critical | 9.8 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in kamleshyadav Miraculous Core Plugin miraculouscore allows Privilege Escalation.This issue affects Miraculous Co… |
CVE-2025-49387 | Critical | 10.0 | 2025-08-28 | Unrestricted Upload of File with Dangerous Type vulnerability in add-ons.org Drag and Drop File Upload for Elementor Forms drag-and-drop-file-upload-for-elemen… |
CVE-2025-49383 | High | 8.1 | 2025-08-28 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Neresa neresa-wp allows PHP… |
CVE-2025-48365 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in imaprogrammer Custom Comment customcomment allows Stored… |
CVE-2025-48364 | Medium | 4.9 | 2025-08-28 | Server-Side Request Forgery (SSRF) vulnerability in vEnCa-X rajce rajce allows Server Side Request Forgery.This issue affects rajce: from n/a through <= 0.4.2. |
CVE-2025-48363 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issu… |
CVE-2025-48362 | Medium | 5.4 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affec… |
CVE-2025-48361 | Medium | 5.3 | 2025-08-28 | Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Retrieve Embedded Sensitive… |
CVE-2025-48360 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows… |
CVE-2025-48359 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in thaihavnn07 ATT YouTube Widget att-youtube allows Stored XSS.This issue affects ATT YouTube Widget: from n/a… |
CVE-2025-48358 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommer… |
CVE-2025-48357 | Medium | 5.4 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Theme Century Century ToolKit century-toolkit allows Cross Site Request Forgery.This issue affects Century T… |
CVE-2025-48356 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affec… |
CVE-2025-48354 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Element… |
CVE-2025-48353 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in dactum Clickbank WordPress Plugin (Niche Storefront) clickbank-niche-storefronts allows Stored XSS.This issu… |
CVE-2025-48352 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger yandex-pinger… |
CVE-2025-48351 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in PluginsPoint Kento Splash Screen kento-splash-screen allows Stored XSS.This issue affects Kento Splash Scree… |
CVE-2025-48350 | Medium | 4.3 | 2025-08-28 | Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-48349 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smar… |
CVE-2025-48348 | Medium | 4.3 | 2025-08-28 | Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline site-offline allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-48347 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bx… |
CVE-2025-48343 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Aaron Axelsen WPMU Ldap Authentication wpmuldap allows Stored XSS.This issue affects WPMU Ldap Authenticatio… |
CVE-2025-48327 | Medium | 5.3 | 2025-08-28 | Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-48325 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in shmish111 WP Admin Theme wp-admin-theme allows Stored XSS.This issue affects WP Admin Theme: from n/a throug… |
CVE-2025-48324 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-… |
CVE-2025-48323 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allo… |
CVE-2025-48322 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XS… |
CVE-2025-48321 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in dyiosah Ultimate twitter profile widget ultimate-twitter-profile-widget allows Stored XSS.This issue affects… |
CVE-2025-48320 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in cuckoohello 百度分享按钮 baidushare-wp allows Stored XSS.This issue affects 百度分享按钮: from n/a through <= 1.0.6. |
CVE-2025-48319 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reser… |
CVE-2025-48318 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 duoshuo allows Cross Site Request Forgery.This issue affects 多说社会化评论框: from n/a through <= 1… |
CVE-2025-48316 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobi… |
CVE-2025-48315 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Sto… |
CVE-2025-48314 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored… |
CVE-2025-48313 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode tripadvisor-shortcode a… |
CVE-2025-48312 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Sto… |
CVE-2025-48311 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in OffClicks Invisible Optin invisible-optin allows Stored XSS.This issue affects Invisible Optin: from n/a thr… |
CVE-2025-48310 | Medium | 4.3 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor wp-table-editor allows Cross Site Request Forgery.This issue affects Table Editor… |
CVE-2025-48309 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in web-able BetPress betpress allows Stored XSS.This issue affects BetPress: from n/a through <= 1.0.1 Lite. |
CVE-2025-48308 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in nonletter Newsletter subscription optin module newsletter-subscription-widget-for-sendblaster allows Stored… |
CVE-2025-48307 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao SEO For Images seo-for-images allows Stored XSS.This issue affects SEO For Images: from n/a throug… |
CVE-2025-48306 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in developers savyour Savyour Affiliate Partner savyour-affiliate-partner allows Stored XSS.This issue affects… |
CVE-2025-48305 | Medium | 5.9 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreo… |
CVE-2025-48304 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Gary Illyes Google XML News Sitemap plugin gn-xml-sitemap allows Stored XSS.This issue affects Google XML Ne… |
CVE-2025-48110 | Medium | 6.5 | 2025-08-28 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue… |
CVE-2025-48109 | High | 7.1 | 2025-08-28 | Cross-Site Request Forgery (CSRF) vulnerability in Xavier Media XM-Backup xm-backup allows Stored XSS.This issue affects XM-Backup: from n/a through <= 0.9.1. |
CVE-2025-48100 | Critical | 9.1 | 2025-08-28 | Improper Control of Generation of Code ('Code Injection') vulnerability in extremeidea bidorbuy Store Integrator bidorbuystoreintegrator allows Remote Code Inc… |
CVE-2025-9376 | Medium | 6.5 | 2025-08-28 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an… |
CVE-2025-39496 | Critical | 9.3 | 2025-08-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This… |
CVE-2025-55175 | Medium | 6.1 | 2025-08-28 | QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, wh… |
CVE-2025-54544 | Medium | 4.8 | 2025-08-28 | QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject arb… |
CVE-2025-54543 | Medium | 4.8 | 2025-08-28 | QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbit… |
CVE-2025-54542 | Medium | 5.5 | 2025-08-28 | QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials… |
CVE-2025-54541 | Medium | 4.3 | 2025-08-28 | QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the ad… |
CVE-2025-54540 | Medium | 6.1 | 2025-08-28 | QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when o… |
CVE-2025-48963 | High | 7.3 | 2025-08-28 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) b… |
CVE-2025-58081 | High | 7.5 | 2025-08-28 | Use of hard-coded password issue/vulnerability in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0a and earlier) allows a remote unauthenticated attacker to… |