2025 CVEs (page 277)
Page 277 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52789 | High | 7.1 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a throug… |
CVE-2025-52784 | High | 7.1 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post bluff-post allows Stored XSS.This issue affects Bluff Post: from n/a through <= 1.1.1. |
CVE-2025-52783 | High | 7.1 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in themelocation Change Cart button Colors WooCommerce wc-style allows Stored XSS.This issue affects Change Car… |
CVE-2025-52782 | High | 7.1 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in King Rayhan Scroll UP scroll-to-up allows Reflected XSS.T… |
CVE-2025-52781 | High | 7.1 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav tinynav allows Stored XSS.This issue affects TinyNav: from n/a through <= 1.4. |
CVE-2025-52780 | High | 7.1 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Mohammad Parsa Logo Manager For Samandehi samandehi-logo-manager allows Stored XSS.This issue affects Logo M… |
CVE-2025-52772 | High | 7.1 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Adnan Haque (a11n) Virtual Moderator allows Cross-Site Scripting (XSS). This issue affects Virtual Moderator… |
CVE-2025-52733 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anonform Ab ANON::form embedded secure form anonform-embe… |
CVE-2025-52719 | Medium | 4.3 | 2025-06-20 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communi… |
CVE-2025-52715 | High | 7.5 | 2025-06-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Classified Listing classif… |
CVE-2025-52713 | Medium | 6.4 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Server Side Request Forgery.This is… |
CVE-2025-52711 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Cross Site Request Forgery.This issu… |
CVE-2025-52710 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ninja Team File Manager Pro filester allows Stored XSS.Th… |
CVE-2025-52708 | High | 7.5 | 2025-06-20 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RealMag777 HUSKY woocommerce-products-… |
CVE-2025-52707 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firelight Firelight Lightbox easy-fancybox allows Stored… |
CVE-2025-50051 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chad Butler WP-Members wp-members allows Stored XSS.This… |
CVE-2025-50050 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BlueGlass Interactive AG Jobs for WordPress job-postings… |
CVE-2025-50049 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in prismtechstudios Modern Footnotes modern-footnotes allows… |
CVE-2025-50048 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atakan Au Automatically Hierarchic Categories in Menu aut… |
CVE-2025-50047 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue af… |
CVE-2025-50046 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StellarWP WPComplete wpcomplete allows Stored XSS.This is… |
CVE-2025-50045 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProWCPlugins Related Products Manager for WooCommerce rel… |
CVE-2025-50044 | Medium | 6.5 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Cross Site Request Forgery.This issue affects Re… |
CVE-2025-50043 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Code Engine code-engine allows Stored XSS.This… |
CVE-2025-50042 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Register Profile With Shortcode wp-regi… |
CVE-2025-50041 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Engine Gutenberg Blocks – ACF Blocks Suite acf-blocks… |
CVE-2025-50038 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anantaddons Anant Addons for Elementor anant-addons-for-e… |
CVE-2025-50037 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Buying Buddy Buying Buddy IDX CRM buying-buddy-idx-crm al… |
CVE-2025-50036 | Medium | 6.5 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows Cross Site Request Forgery.This issue affects M… |
CVE-2025-50035 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XS… |
CVE-2025-50034 | Medium | 6.5 | 2025-06-20 | Missing Authorization vulnerability in Mahmudul Hasan Arif Enhanced Blocks – Page Builder Blocks for Gutenberg enhanced-blocks allows Exploiting Incorrectly Co… |
CVE-2025-50033 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Fitness Park fitness-park allows DOM-Base… |
CVE-2025-50030 | Medium | 6.5 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sparklewpthemes Spark Multipurpose spark-multipurpose all… |
CVE-2025-50027 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows S… |
CVE-2025-50026 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spoki Spoki spoki allows Stored XSS.This issue affects Sp… |
CVE-2025-50025 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople CP Polls cp-polls allows Stored XSS.This issue… |
CVE-2025-50024 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Truong Thanh ATP Call Now atp-call-now allows Stored XSS… |
CVE-2025-50023 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Coyier CodePen Embed Block codepen-embed-block allo… |
CVE-2025-50022 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JK WP-FB-AutoConnect wp-fb-autoconnect allows Stored XSS… |
CVE-2025-50021 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Peake Better Random Redirect better-random-redirec… |
CVE-2025-50020 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nitin Yawalkar RDFa Breadcrumb rdfa-breadcrumb allows Sto… |
CVE-2025-50019 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sandor Kovacs Simple Sticky Footer simple-sticky-footer… |
CVE-2025-50018 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tealium Tealium tealium allows Stored XSS.This issue affe… |
CVE-2025-50017 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt WP Voting Contest wp-voting-contest allows Stored XS… |
CVE-2025-50016 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XS… |
CVE-2025-50015 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodrigo Bastos Hand Talk handtalk allows Stored XSS.This… |
CVE-2025-50014 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iamapinan PDPA Consent for Thailand pdpa-consent allows S… |
CVE-2025-50013 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Judge CSV Importer Improved csv-importer-improved a… |
CVE-2025-50012 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fridaysystems Inventory Presser inventory-presser allows… |
CVE-2025-50011 | Medium | 5.9 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. T… |
CVE-2025-50010 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Zapier Zapier for WordPress zapier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-50009 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Climax Themes Kata Plus kata-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-50008 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in cscode WooCommerce Manager – Customize and Control Cart page, Add to Cart button, Checkout fields easily innovs-woo-mana… |
CVE-2025-49998 | Medium | 5.4 | 2025-06-20 | Missing Authorization vulnerability in Wetail WooCommerce Fortnox Integration woocommerce-fortnox-integration allows Exploiting Incorrectly Configured Access C… |
CVE-2025-49997 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Accessing Functionality Not Properly Constrained by… |
CVE-2025-49996 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Accessing Functionality Not Properly Constra… |
CVE-2025-49995 | Medium | 5.3 | 2025-06-20 | Authorization Bypass Through User-Controlled Key vulnerability in dFactory Download Attachments download-attachments allows Exploiting Incorrectly Configured A… |
CVE-2025-49993 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in csarturas Cookie-Script.com cookie-script-com allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-49991 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in tggfref WP-Recall allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects WP-Recall: from n/… |
CVE-2025-49990 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in contentstudio Contentstudio contentstudio allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-49989 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in App Cheap App Builder app-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-49988 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in Renzo Johnson Contact Form 7 AWeber Extension integrate-contact-form-7-and-aweber allows Exploiting Incorrectly Configur… |
CVE-2025-49987 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in WPFactory CRM ERP Business Solution crm-erp-business-solution allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-49986 | Medium | 5.3 | 2025-06-20 | Missing Authorization vulnerability in thanhtungtnt Video List Manager video-list-manager allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2025-49985 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in Ali Irani Auto Upload Images auto-upload-images allows Server Side Request Forgery.This issue affects Auto… |
CVE-2025-49984 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in blubrry PowerPress Podcasting powerpress allows Server Side Request Forgery.This issue affects PowerPress P… |
CVE-2025-49983 | Medium | 4.9 | 2025-06-20 | Server-Side Request Forgery (SSRF) vulnerability in Joe Hoyle WPThumb wp-thumb allows Server Side Request Forgery.This issue affects WPThumb: from n/a through… |
CVE-2025-49982 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in aguilatechnologies WP Customer Area customer-area allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-49981 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in mahabub81 User Roles and Capabilities user-roles-and-capabilities allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-49980 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in WP Event Manager WP User Profile Avatar wp-user-profile-avatar allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-49979 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-49978 | Medium | 4.3 | 2025-06-20 | Authorization Bypass Through User-Controlled Key vulnerability in eyecix JobSearch wp-jobsearch allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-49977 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in WP Inventory WP Inventory Manager wp-inventory-manager allows Cross Site Request Forgery.This issue affects… |
CVE-2025-49976 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-49975 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2… |
CVE-2025-49974 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Acc… |
CVE-2025-49973 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in GrandPlugins Image Sizes Controller, Create Custom Image Sizes, Disable Image Sizes image-sizes-controller allows Exploi… |
CVE-2025-49972 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in David Wood TM Replace Howdy tm-replace-howdy allows Cross Site Request Forgery.This issue affects TM Replace… |
CVE-2025-49971 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in aThemeArt Translations eDS Responsive Menu eds-responsive-menu allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-49970 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in sparklewpthemes Hello FSE Blog hello-fse-blog allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-49969 | Medium | 4.3 | 2025-06-20 | Missing Authorization vulnerability in Zara 4 Zara 4 Image Compression zara-4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-49968 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Oganro XML Travel Portal Widget oganro-reservation-widget allows Cross Site Request Forgery.This issue affec… |
CVE-2025-49967 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in marcusjansen Live Sports Streamthunder live-sports-streamthunder allows Cross Site Request Forgery.This issu… |
CVE-2025-49966 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Oganro Oganro Travel Portal Search Widget for HotelBeds APITUDE API oganro-travel-portal-search-widget-for-h… |
CVE-2025-49965 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in Oganro PixelBeds Channel Manager and Hotel Booking Engine pixelbeds-channel-manager-booking-engine allows Cr… |
CVE-2025-49964 | Medium | 4.3 | 2025-06-20 | Cross-Site Request Forgery (CSRF) vulnerability in indgeek ClipLink cliplink allows Cross Site Request Forgery.This issue affects ClipLink: from n/a through <=… |
CVE-2025-49873 | High | 7.1 | 2025-06-20 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Elessi elessi-theme allows Reflected XSS.This i… |
CVE-2025-46179 | Critical | 9.8 | 2025-06-20 | A SQL Injection vulnerability was discovered in the askquery.php file of CloudClassroom-PHP Project v1.0. The squeryx parameter accepts unsanitized input, whic… |
CVE-2025-3319 | High | 8.1 | 2025-06-20 | IBM Spectrum Protect Server 8.1 through 8.1.26 could allow attacker to bypass authentication due to improper session authentication which can result in access… |
CVE-2025-3228 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly retrieve requestorInfo from play… |
CVE-2025-3227 | Medium | 4.3 | 2025-06-20 | Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member managemen… |
CVE-2025-6344 | High | 7.3 | 2025-06-20 | A vulnerability has been found in code-projects Online Shoe Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-6343 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, was found in code-projects Online Shoe Store 1.0. Affected is an unknown function of the file /admin/admin_p… |
CVE-2025-6342 | High | 7.3 | 2025-06-20 | A vulnerability, which was classified as critical, has been found in code-projects Online Shoe Store 1.0. This issue affects some unknown processing of the fil… |
CVE-2025-48706 | Critical | 9.1 | 2025-06-20 | An issue was discovered in COROS PACE 3 through 3.0808.0. Due to an out-of-bounds read vulnerability, sending a crafted BLE message forces the device to reboot. |
CVE-2025-48705 | High | 7.5 | 2025-06-20 | An issue was discovered in COROS PACE 3 through 3.0808.0. Due to a NULL pointer dereference vulnerability, sending a crafted BLE message forces the device to r… |
CVE-2025-32880 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. With WLAN access, the COROS Pace 3 d… |
CVE-2025-32879 | High | 8.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It starts advertising if no device is connected via Bluetooth. This allows an attacker to con… |
CVE-2025-32878 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It implements a function to connect the watch to a WLAN. This function is mainly for download… |
CVE-2025-32877 | Critical | 9.8 | 2025-06-20 | An issue was discovered on COROS PACE 3 devices through 3.0808.0. It identifies itself as a device without input or output capabilities, which results in the u… |