2025 CVEs (page 295)
Page 295 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49262 | High | 7.6 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shaonsina Sina Extension for Elementor sina-extension-for… |
CVE-2025-49250 | Medium | 4.3 | 2025-06-06 | Improper Control of Generation of Code ('Code Injection') vulnerability in cmoreira Team Showcase team-showcase-cm allows Code Injection.This issue affects Tea… |
CVE-2025-49248 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in cmoreira Team Showcase team-showcase-cm allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-49246 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-49244 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate shortcodes-ultimate allows Store… |
CVE-2025-49243 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-res… |
CVE-2025-49242 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu… |
CVE-2025-49241 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in bobbingwide oik oik allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects oik: from… |
CVE-2025-49240 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPr… |
CVE-2025-49239 | Medium | 5.4 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site R… |
CVE-2025-49238 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Bac… |
CVE-2025-49237 | High | 7.4 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in POEditor POEditor poeditor allows Path Traversal.This issue affects POEditor: from n/a through <= 0.9.10. |
CVE-2025-49236 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in raychat Raychat raychat allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Raychat: from… |
CVE-2025-49235 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XS… |
CVE-2025-49073 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in axiomthemes Sweet Dessert sweet-dessert allows Object Injection.This issue affects Sweet Dessert: from n/a t… |
CVE-2025-49072 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy mr-murphy allows Object Injection.This issue affects Mr. Murphy: from n/a through <… |
CVE-2025-38000 | High | 7.8 | 2025-06-06 | In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() When enqueuing the fi… |
CVE-2025-31025 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksera Image Hover Effects Block image-hover-effects-b… |
CVE-2025-31000 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in Miguel Fuentes Payment QR WooCommerce payment-qr-woo allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-30999 | High | 7.5 | 2025-06-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fahad Mahmood External Store for Shopi… |
CVE-2025-30997 | Medium | 5.4 | 2025-06-06 | Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects… |
CVE-2025-30995 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages L… |
CVE-2025-30994 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Cross Site Request Forgery.This issue affects CubeWP: from n/a… |
CVE-2025-30991 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages al… |
CVE-2025-30990 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-30989 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Renzo Tejada Libro de Reclamaciones y Quejas libro-de-rec… |
CVE-2025-30986 | Medium | 5.4 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Cross Site Request Forgery.This issue affects E… |
CVE-2025-30981 | Medium | 6.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14. |
CVE-2025-30980 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue… |
CVE-2025-30978 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in Dor Zuberi Slack Notifications by dorzki dorzki-notifications-to-slack allows Exploiting Incorrectly Configured Access C… |
CVE-2025-30977 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This… |
CVE-2025-30976 | Medium | 4.9 | 2025-06-06 | Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a… |
CVE-2025-30974 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-30968 | Medium | 5.4 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in jokerbr313 Advanced Post List advanced-post-list allows Cross Site Request Forgery.This issue affects Advanc… |
CVE-2025-30958 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-30957 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access… |
CVE-2025-30956 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Booqable Rental Software Booqable Rental booqable-rental-reservations allows Cross Site Request Forgery.This… |
CVE-2025-30954 | Medium | 4.7 | 2025-06-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.Thi… |
CVE-2025-30953 | Medium | 4.7 | 2025-06-06 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue af… |
CVE-2025-30952 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This iss… |
CVE-2025-30951 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blocks… |
CVE-2025-30950 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham All Currencies for WooCommerce woocommerce-all-cu… |
CVE-2025-30948 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Giraphix Creative Layouts for Elementor layouts-for-elementor allows Cross Site Request Forgery.This issue a… |
CVE-2025-30946 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Michael Cannon Custom Bulk/Quick Edit custom-bulkquick-edit allows Cross Site Request Forgery.This issue aff… |
CVE-2025-30945 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in taskbuilder Taskbuilder taskbuilder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects T… |
CVE-2025-30942 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templat… |
CVE-2025-30941 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marvie Pons Pinterest Verify Meta Tag pinterest-verify-me… |
CVE-2025-30940 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in melipayamak Melipayamak melipayamak allows Stored XSS.Thi… |
CVE-2025-30939 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debashish IFrame Widget iframe-widget allows Stored XSS.T… |
CVE-2025-30938 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in broadly Broadly for WordPress broadly allows Stored XSS.T… |
CVE-2025-30937 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stefanledin Responsify WP responsify-wp allows Stored XSS… |
CVE-2025-30935 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NickDuncan Contact Form contact-form-ready allows DOM-Bas… |
CVE-2025-30934 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in OLIVESYSTEM 診断ジェネレータ作成プラグイン os-diagnosis-generator allows Accessing Functionality Not Properly Constrained by ACLs.This… |
CVE-2025-30932 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-30931 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamil Shafeev «Подсказки» от DaData.ru dadata-ru allows… |
CVE-2025-30930 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unreal Themes ACF: Yandex Maps Field acf-yandex-maps-fiel… |
CVE-2025-30928 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vicchi WP Biographia wp-biographia allows Stored XSS.This… |
CVE-2025-30927 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in Wordapp Team Wordapp wordapp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-30638 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PowieT Powie's Uptime Robot powies-uptime-robot allows St… |
CVE-2025-30637 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Stor… |
CVE-2025-30636 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-30634 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IWEBIX WP Featured Content Slider wp-featured-content-sli… |
CVE-2025-30632 | Medium | 5.4 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in pozzad Global Translator global-translator allows Cross Site Request Forgery.This issue affects Global Trans… |
CVE-2025-30630 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pozzad Global Translator global-translator allows Stored… |
CVE-2025-30629 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Codehaveli Bitly URL Shortener codehaveli-bitly-url-shortener allows Cross Site Request Forgery.This issue a… |
CVE-2025-30627 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in regolithsjk Elegant Visitor Counter elegant-visitor-count… |
CVE-2025-30625 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt Pramschufer AppBanners appbanners allows Stored XSS… |
CVE-2025-30624 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in WordLift WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wo… |
CVE-2025-29013 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in faaiq Custom Category/Post Type Post order custom-post-order-category allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-29011 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer YouTube Simple Gallery youtube-simple-galler… |
CVE-2025-29010 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Exploiting Incorrectly Configured Access… |
CVE-2025-29008 | Medium | 4.9 | 2025-06-06 | Server-Side Request Forgery (SSRF) vulnerability in ShawonPro SocialMark socialmark allows Server Side Request Forgery.This issue affects SocialMark: from n/a… |
CVE-2025-29006 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in centangle Direct Checkout for WooCommerce Lite woo-direct-checkout-lite allows Accessing Functionality Not Properly Cons… |
CVE-2025-29005 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery… |
CVE-2025-29003 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mva7 The Holiday Calendar the-holiday-calendar allows Sto… |
CVE-2025-28997 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-28996 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in Thad Allender GPP Slideshow gpp-slideshow allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-28995 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-28994 | Medium | 4.3 | 2025-06-06 | Missing Authorization vulnerability in viralloops Viral Loops WP Integration viral-loops-wp-integration allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-28989 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arildur Read More Login read-more-login allows Stored XSS… |
CVE-2025-28986 | High | 8.2 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Webaholicson Epicwin Plugin epicwin-subscribers allows SQL Injection.This issue affects Epicwin Plugin: from… |
CVE-2025-28985 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in Elastic Email Elastic Email Subscribe Form elastic-email-subscribe-form allows Exploiting Incorrectly Configured Access… |
CVE-2025-28984 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in storepro Subscription Renewal Reminders for WooCommerce subscriptions-renewal-reminders allows Cross Site Re… |
CVE-2025-28981 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Soli WP Mail Options wp-mail-options allows Stored XSS.This issue affects WP Mail Options: from n/a through… |
CVE-2025-28974 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in mail250 Free WP Mail SMTP free-wp-mail-smtp allows Stored XSS.This issue affects Free WP Mail SMTP: from n/a… |
CVE-2025-28966 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in dilemma123 Recent Posts Slider Responsive recent-posts-slider-responsive allows Stored XSS.This issue affect… |
CVE-2025-28964 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in mangup Personal Favicon personal-favicon allows Stored XSS.This issue affects Personal Favicon: from n/a thr… |
CVE-2025-28958 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Vadim Bogaiskov Bg Orthodox Calendar bg-orthodox-calendar allows Stored XSS.This issue affects Bg Orthodox C… |
CVE-2025-28954 | High | 7.4 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in wphobby Backwp backwp allows Path Traversal.This issue affects Backwp: from n/a through <= 2.0.2. |
CVE-2025-28952 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a… |
CVE-2025-28950 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in David Shabtai Post Author post-author allows Stored XSS.This issue affects Post Author: from n/a through <=… |
CVE-2025-28948 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in codedraft Mediabay - WordPress Media Library Folders allows Reflected XSS. This issue affects Mediabay - Wor… |
CVE-2025-27360 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in WP Corner Quick Event Calendar quick-event-calendar allows Cross Site Request Forgery.This issue affects Qui… |
CVE-2025-27359 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Media File Type Manager wp-media-file-type-manager allows Cross Site Request Forgery.This issue af… |
CVE-2025-27334 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ángel C. Simple Google Static Map simple-google-static-ma… |
CVE-2025-26593 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in FasterThemes FastBook fastbook-responsive-appointment-booking-and-scheduling-system allows Cross Site Reques… |
CVE-2025-26590 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nir Complete Google Seo Scan complete-google-seo-scan all… |
CVE-2025-24778 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in De paragon No Spam At All no-spam-at-all allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-24776 | Medium | 5.4 | 2025-06-06 | Missing Authorization vulnerability in codelobster Responsive Flipbooks responsive-flipbooks allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-24772 | Medium | 5.4 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Cross Site Request Forgery.This issue affect… |