2025 CVEs (page 264)
Page 264 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48231 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar… |
CVE-2025-47634 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-47627 | High | 7.5 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LCweb PrivateContent - Mail Actions al… |
CVE-2025-47565 | Medium | 6.3 | 2025-07-04 | Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Even… |
CVE-2025-47479 | Medium | 5.3 | 2025-07-04 | Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a throug… |
CVE-2025-39487 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie valvepress-rankie allows Reflected XSS… |
CVE-2025-32311 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.Thi… |
CVE-2025-32297 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directo… |
CVE-2025-31037 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue af… |
CVE-2025-30933 | Critical | 10.0 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue a… |
CVE-2025-28983 | Critical | 9.8 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Es… |
CVE-2025-28980 | High | 7.7 | 2025-07-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-no… |
CVE-2025-28978 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hung Trang Si SB Breadcrumbs sb-breadcrumbs allows Reflec… |
CVE-2025-28976 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dsrodzin Email Address Security by WebEmailProtector webe… |
CVE-2025-28968 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac WP Wall wp-wall allows Reflected XSS.Th… |
CVE-2025-24780 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for Woo… |
CVE-2025-24771 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light all… |
CVE-2025-23970 | Critical | 9.8 | 2025-07-04 | Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booki… |
CVE-2025-7060 | Medium | 4.1 | 2025-07-04 | A vulnerability was found in Monitorr up to 1.7.6m. It has been classified as problematic. This affects an unknown part of the file assets/config/_installation… |
CVE-2025-38176 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in binderfs_evict_inode() Running 'stress-ng --binderfs 16 --t… |
CVE-2025-38175 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: binder: fix yet another UAF in binder_devices Commit e77aff5528a18 ("binderfs: fix use-af… |
CVE-2025-38174 | High | 8.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Do not double dequeue a configuration request Some of our devices crash in t… |
CVE-2025-5920 | High | 7.5 | 2025-07-04 | The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the… |
CVE-2025-5351 | Medium | 6.5 | 2025-07-04 | A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serial… |
CVE-2025-53569 | Medium | 4.3 | 2025-07-04 | Cross-Site Request Forgery (CSRF) vulnerability in Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) trust-payments-gateway-3ds2 allow… |
CVE-2025-53568 | Medium | 4.3 | 2025-07-04 | Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station allows Cross Site Request Forgery.This issue affects Radio Station: f… |
CVE-2025-53566 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-st… |
CVE-2025-30983 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Card flip image slideshow card-flip-image-slides… |
CVE-2025-30979 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery pixelating-im… |
CVE-2025-30969 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery wp-iframe-images-gallery a… |
CVE-2025-30947 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Cool fade popup cool-fade-popup allows Blind SQL… |
CVE-2025-30943 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Posts Slider Shortcode posts-slider-shortc… |
CVE-2025-30929 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects flu… |
CVE-2025-29012 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-29007 | Medium | 4.3 | 2025-07-04 | Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-29001 | Medium | 4.3 | 2025-07-04 | Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2025-28971 | Medium | 5.9 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider… |
CVE-2025-28969 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection… |
CVE-2025-28967 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Truman Contact Us page - Contact people LITE contac… |
CVE-2025-28963 | Medium | 5.4 | 2025-07-04 | Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Server Side Request Forgery.This issue affects URL Sho… |
CVE-2025-28957 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OwnerRez OwnerRez API ownerrez allows Stored XSS.This iss… |
CVE-2025-28951 | Critical | 9.1 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.Th… |
CVE-2025-27358 | Medium | 4.6 | 2025-07-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows C… |
CVE-2025-27326 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows S… |
CVE-2025-26591 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam WP fancybox wp-fancybox allows Stored XSS.This… |
CVE-2025-24764 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones (Simply) Guest Author Name guest-author-name all… |
CVE-2025-24757 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in AndonDesign uDesign udesign.This issue affects uDesign: from n/a through <= 4.11.2. |
CVE-2025-24748 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in ThemeFusion Avada avada.This issue affects Avada: from n/a through <= 7.11.10. |
CVE-2025-24735 | High | 7.7 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chatra Chatra Live Chat + ChatBot + Cart Saver allows Sto… |
CVE-2025-23972 | Medium | 4.3 | 2025-07-04 | Cross-Site Request Forgery (CSRF) vulnerability in Brian S. Reed Contact Form 7 reCAPTCHA contact-form-7-recaptcha allows Cross Site Request Forgery.This issue… |
CVE-2025-6673 | Medium | 6.4 | 2025-07-04 | The Easy restaurant menu manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's nsc_eprm_menu_link shortcode in versions up… |
CVE-2025-53600 | High | 7.5 | 2025-07-04 | Whale browser before 4.32.315.22 allow an attacker to bypass the Same-Origin Policy in a dual-tab environment. |
CVE-2025-53599 | Critical | 9.8 | 2025-07-04 | Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme. |
CVE-2025-32918 | High | 8.8 | 2025-07-04 | Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2… |
CVE-2025-6944 | Medium | 6.4 | 2025-07-04 | The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all ve… |
CVE-2025-5372 | Medium | 5.0 | 2025-07-04 | A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to i… |
CVE-2025-7053 | Low | 3.5 | 2025-07-04 | A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save… |
CVE-2025-7046 | Medium | 6.4 | 2025-07-04 | The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plug… |
CVE-2025-6814 | High | 7.5 | 2025-07-04 | The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1.0… |
CVE-2025-6787 | Medium | 6.4 | 2025-07-04 | The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versions up to, and inclu… |
CVE-2025-6786 | Medium | 5.3 | 2025-07-04 | The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirectin… |
CVE-2025-6783 | High | 7.5 | 2025-07-04 | The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including… |
CVE-2025-6782 | High | 7.5 | 2025-07-04 | The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and i… |
CVE-2025-6739 | Medium | 6.5 | 2025-07-04 | The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due… |
CVE-2025-6729 | Medium | 6.4 | 2025-07-04 | The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_p… |
CVE-2025-6586 | High | 7.2 | 2025-07-04 | The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_locInstall function in… |
CVE-2025-6238 | High | 8.0 | 2025-07-04 | The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' para… |
CVE-2025-6041 | Medium | 6.1 | 2025-07-04 | The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorre… |
CVE-2025-6039 | Medium | 6.4 | 2025-07-04 | The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and… |
CVE-2025-5956 | Medium | 6.5 | 2025-07-04 | The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee()… |
CVE-2025-5953 | High | 8.8 | 2025-07-04 | The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and upda… |
CVE-2025-5933 | Medium | 4.3 | 2025-07-04 | The RD Contacto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect… |
CVE-2025-5924 | Medium | 4.3 | 2025-07-04 | The WP Firebase Push Notification plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.0. This is due to… |
CVE-2025-5567 | Medium | 6.4 | 2025-07-04 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-url' DOM element attribute in al… |
CVE-2025-5322 | High | 7.2 | 2025-07-03 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the do_updateca… |
CVE-2025-53367 | | 2025-07-03 | DjVuLibre is a GPL implementation of DjVu, a web-centric format for distributing documents and images. Prior to version 3.5.29, the MMRDecoder::scanruns method… | |
CVE-2025-49826 | High | 7.5 | 2025-07-03 | Next.js is a React framework for building full-stack web applications. From versions 15.0.4-canary.51 to before 15.1.8, a cache poisoning bug leading to a Deni… |
CVE-2025-49005 | Low | 3.7 | 2025-07-03 | Next.js is a React framework for building full-stack web applications. In Next.js App Router from 15.3.0 to before 15.3.3 and Vercel CLI from 41.4.1 to 42.2.0… |
CVE-2025-53370 | High | 8.6 | 2025-07-03 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, short descriptions set via the ShortDes… |
CVE-2025-53369 | High | 8.6 | 2025-07-03 | Short Description is a MediaWiki extension that provides local short description support. In version 4.0.0, short descriptions are not properly sanitized befor… |
CVE-2025-53368 | High | 8.6 | 2025-07-03 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. From versions 1.9.4 to before 3.4.0, page descriptions are inserted into raw… |
CVE-2025-52554 | Medium | 4.3 | 2025-07-03 | n8n is a workflow automation platform. Prior to version 1.99.1, an authorization vulnerability was discovered in the /rest/executions/:id/stop endpoint of n8n… |
CVE-2025-34089 | | 2025-07-03 | An unauthenticated remote code execution vulnerability exists in Remote for Mac, a macOS remote control utility developed by Aexol Studio, in versions up to an… | |
CVE-2025-34088 | High | 8.8 | 2025-07-03 | An authenticated remote code execution vulnerability exists in Pandora FMS version 7.0NG and earlier. The net_tools.php functionality allows authenticated user… |
CVE-2025-34087 | High | 8.8 | 2025-07-03 | An authenticated command injection vulnerability exists in Pi-hole versions up to 3.3. When adding a domain to the allowlist via the web interface, the domain… |
CVE-2025-34086 | High | 8.8 | 2025-07-03 | Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with… |
CVE-2025-34082 | | 2025-07-03 | A command injection vulnerability exists in IGEL OS versions prior to 11.04.270 within the Secure Terminal and Secure Shadow services. The flaw arises due to i… | |
CVE-2025-34061 | | 2025-07-03 | A backdoor in PHPStudy versions 2016 through 2018 allows unauthenticated remote attackers to execute arbitrary PHP code on affected installations. The backdoor… | |
CVE-2025-45809 | Medium | 5.4 | 2025-07-03 | SQL Injection vulnerability in BerriAI LiteLLM before 1.81.0 allows attackers to execute arbitrary commands via the key parameter to the "/key/block" and "/key… |
CVE-2025-23968 | Critical | 9.1 | 2025-07-03 | Unrestricted Upload of File with Dangerous Type vulnerability in WebFactory AiBud WP aibuddy-openai-chatgpt allows Upload a Web Shell to a Web Server.This issu… |
CVE-2025-6926 | High | 8.8 | 2025-07-03 | Improper Authentication vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows : Bypass Authentication.This issue affects Mediawiki - C… |
CVE-2025-6074 | Medium | 6.5 | 2025-07-03 | Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains ac… |
CVE-2025-6073 | High | 7.5 | 2025-07-03 | Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to th… |
CVE-2025-6072 | High | 7.5 | 2025-07-03 | Stack-based Buffer Overflow vulnerability in ABB RMC-100, ABB RMC-100 LITE. When the REST interface is enabled by the user, and an attacker gains access to … |
CVE-2025-6071 | Medium | 5.3 | 2025-07-03 | Use of Hard-coded Cryptographic Key vulnerability in ABB RMC-100, ABB RMC-100 LITE. An attacker can gain access to salted information to decrypt MQTT informa… |
CVE-2025-53502 | Medium | 6.5 | 2025-07-03 | Improper Input Validation vulnerability in Wikimedia Foundation Mediawiki - FeaturedFeeds Extension allows Cross-Site Scripting (XSS).This issue affects Mediaw… |
CVE-2025-53501 | High | 8.8 | 2025-07-03 | Improper Access Control vulnerability in Wikimedia Foundation Mediawiki - Scribunto Extension allows : Accessing Functionality Not Properly Constrained by Auth… |
CVE-2025-53500 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MassEditRegex Ext… |
CVE-2025-53489 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Ext… |
CVE-2025-49846 | | 2025-07-03 | wire-ios is an iOS client for the Wire secure messaging application. From Wire iOS 3.111.1 to before 3.124.1, messages that were visible in the view port have… |