2025 CVEs (page 336)
Page 336 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3866 | Medium | 6.1 | 2025-04-25 | The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0… |
CVE-2025-3743 | Medium | 5.3 | 2025-04-25 | The Upsell Funnel Builder for WooCommerce plugin for WordPress is vulnerable to order manipulation in all versions up to, and including, 3.0.0. This is due to… |
CVE-2025-2238 | High | 8.8 | 2025-04-25 | The Vikinger theme for WordPress is vulnerable to privilege in all versions up to, and including, 1.9.30. This is due to insufficient user_meta restrictions in… |
CVE-2025-46613 | High | 7.5 | 2025-04-25 | OpenPLC 3 through 64f9c11 has server.cpp Memory Corruption because a thread may access handleConnections arguments after the parent stack frame becomes unavail… |
CVE-2025-3923 | Medium | 5.3 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-3861 | Medium | 5.4 | 2025-04-25 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured… |
CVE-2025-3511 | High | 7.5 | 2025-04-25 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric Corporation CC-Link IE TSN Remote I/O module, CC-Link IE TSN Analog-Dig… |
CVE-2025-2580 | Medium | 4.9 | 2025-04-25 | The Contact Form by Bit Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.18… |
CVE-2025-0671 | Medium | 6.1 | 2025-04-25 | The Icegram Express WordPress plugin before 5.7.50 does not sanitise and escape some of its Template settings, which could allow high privilege users such as… |
CVE-2025-46599 | Medium | 6.8 | 2025-04-25 | CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is se… |
CVE-2025-3775 | Medium | 6.5 | 2025-04-25 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Ser… |
CVE-2025-3752 | Medium | 6.4 | 2025-04-25 | The Able Player, accessible HTML5 media player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘preload’ parameter in all versions up… |
CVE-2025-46595 | Medium | 6.4 | 2025-04-25 | An XSS issue was discovered in the Flag module before 1.x-3.6.2 for Backdrop CMS. Flag is a module that allows flags to be added to nodes, comments, users, and… |
CVE-2025-46547 | Medium | 5.4 | 2025-04-25 | In Sherpa Orchestrator 141851, the web application lacks protection against CSRF attacks, with resultant effects of an attacker conducting XSS attacks, adding… |
CVE-2025-46546 | Low | 3.5 | 2025-04-25 | In Sherpa Orchestrator 141851, multiple time-based blind SQL injections can be performed by an authenticated user. This affects api/gui/asset/list, /api/gui/fi… |
CVE-2025-46545 | Medium | 4.4 | 2025-04-25 | In Sherpa Orchestrator 141851, the functionality for adding or updating licenses allows for stored XSS attacks by an administrator through the name parameter… |
CVE-2025-46544 | Medium | 6.4 | 2025-04-25 | In Sherpa Orchestrator 141851, a low-privileged user can elevate their privileges by creating new users and roles. |
CVE-2025-43865 | High | 8.2 | 2025-04-25 | React Router is a router for React. In versions on the 7.0 branch prior to version 7.5.2, it's possible to modify pre-rendered data by adding a header to the r… |
CVE-2025-43864 | High | 7.5 | 2025-04-25 | React Router is a router for React. Starting in version 7.2.0 and prior to version 7.5.2, it is possible to force an application to switch to SPA mode by addin… |
CVE-2025-3606 | High | 7.5 | 2025-04-25 | Vestel AC Charger version 3.75.0 contains a vulnerability that could enable an attacker to access files containing sensitive information, such as credenti… |
CVE-2025-2185 | High | 8.0 | 2025-04-25 | ALBEDO Telecom Net.Time - PTP/NTP clock (Serial No. NBC0081P) software release 1.4.4 is vulnerable to an insufficient session expiration vulnerability, which … |
CVE-2025-46275 | Critical | 9.8 | 2025-04-24 | WGS-80HPT-V2 and WGS-4215-8T2S are missing authentication that could allow an attacker to create an administrator account without knowing any existing creden… |
CVE-2025-46274 | Critical | 9.8 | 2025-04-24 | UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to read, manipulate and create entries in the managed database. |
CVE-2025-46273 | Critical | 9.8 | 2025-04-24 | UNI-NMS-Lite uses hard-coded credentials that could allow an unauthenticated attacker to gain administrative privileges to all UNI-NMS managed devices. |
CVE-2025-46272 | Critical | 9.1 | 2025-04-24 | WGS-80HPT-V2 and WGS-4215-8T2S are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute OS commands on the host s… |
CVE-2025-46271 | Critical | 9.1 | 2025-04-24 | UNI-NMS-Lite is vulnerable to a command injection attack that could allow an unauthenticated attacker to read or manipulate device data. |
CVE-2025-3749 | Medium | 6.4 | 2025-04-24 | The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all versions up to, and including, 1.2.3 d… |
CVE-2025-1294 | High | 7.2 | 2025-04-24 | The eForm - WordPress Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.18.0 due to insuff… |
CVE-2025-43861 | Medium | 4.4 | 2025-04-24 | ManageWiki is a MediaWiki extension allowing users to manage wikis. Prior to commit 2f177dc, ManageWiki is vulnerable to reflected or stored XSS in the review… |
CVE-2025-29529 | Medium | 6.5 | 2025-04-24 | ITC Systems Multiplan/Matrix OneCard platform v3.7.4.1002 was discovered to contain a SQL injection vulnerability via the component Forgotpassword.aspx. |
CVE-2025-25777 | High | 8.0 | 2025-04-24 | Insecure Direct Object Reference (IDOR) in Codeastro Bus Ticket Booking System v1.0 allows unauthorized access to user profiles. By manipulating the user ID in… |
CVE-2025-26382 | | 2025-04-24 | Under certain circumstances the iSTAR Configuration Utility (ICU) tool could have a buffer overflow issue | |
CVE-2025-43859 | Critical | 9.1 | 2025-04-24 | h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead… |
CVE-2025-43858 | Critical | 9.2 | 2025-04-24 | YoutubeDLSharp is a wrapper for the command-line video downloaders youtube-dl and yt-dlp. In versions starting from 1.0.0-beta4 and prior to 1.1.2, an unsafe c… |
CVE-2025-31324 | Critical | 10.0 | 2025-04-24 | SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious ex… |
CVE-2025-46542 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeXpert Xpert Tab xpert-tab allows Stored XSS.This iss… |
CVE-2025-46541 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elrata_ WP-reCAPTCHA-bp wp-recaptcha-bp allows Stored XSS… |
CVE-2025-46540 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Mok GNA Search Shortcode gna-search-shortcode allow… |
CVE-2025-46538 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webplanetsoft Inline Text Popup inline-text-popup allows… |
CVE-2025-46536 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RichardHarrison Carousel-of-post-images carousel-of-post-… |
CVE-2025-46534 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DanielRiera Image Style Hover image-content-show-hover al… |
CVE-2025-46533 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress… |
CVE-2025-46532 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haris Zulfiqar Tooltip wp-tooltip allows DOM-Based XSS.Th… |
CVE-2025-46531 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery… |
CVE-2025-46530 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment hacklog-remote-attachment allows Stored XSS.This issue affects Hack… |
CVE-2025-46529 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StressFree Sites Business Contact Widget business-contact… |
CVE-2025-46528 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue affects Availability Calendar: from n/… |
CVE-2025-46525 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in msmitley WP Cookie Consent wp-cookie-consent allows Store… |
CVE-2025-46524 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in stesvis WP Filter Post Category wp-filter-post-categories allows Stored XSS.This issue affects WP Filter Pos… |
CVE-2025-46523 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Custo… |
CVE-2025-46522 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Billy Bryant Tabs gt-tabs allows Stored XSS.This issue affects Tabs: from n/a through <= 4.0.3. |
CVE-2025-46521 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page ws-force-login-page allow… |
CVE-2025-46520 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in alphasis Related Posts via Taxonomies related-posts-via-taxonomies allows Stored XSS.This issue affects Rela… |
CVE-2025-46519 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in M.Code Media Library Downloader media-library-downloader allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-46517 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Blog Manager WP blog-manager-wp allows Stored… |
CVE-2025-46516 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in silencecm Twitter Card Generator twitter-card-generator allows Stored XSS.This issue affects Twitter Card Ge… |
CVE-2025-46514 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allows Stored XSS.This issue affects Milat j… |
CVE-2025-46513 | Medium | 4.3 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite aio-time-clock-lite allows Cross Site Request Forgery.This issue affe… |
CVE-2025-46512 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Shamim Hasan Custom Functions Plugin custom-functions allows Stored XSS.This issue affects Custom Functions… |
CVE-2025-46511 | Medium | 6.4 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects Be… |
CVE-2025-46510 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in harrysudana Contact Form 7 Calendar cf7-calendar allows Stored XSS.This issue affects Contact Form 7 Calenda… |
CVE-2025-46509 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey Mikhalchuk 360 View 360-view allows Stored XSS.Thi… |
CVE-2025-46508 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao Advanced lazy load advanced-lazy-load allows Stored XSS.This issue affects Advanced lazy load: fro… |
CVE-2025-46507 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in ldrumm Unsafe Mimetypes unsafe-mimetypes allows Stored XSS.This issue affects Unsafe Mimetypes: from n/a thr… |
CVE-2025-46506 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliat… |
CVE-2025-46505 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Peekaboo peekaboo allows Stored XSS.This issue… |
CVE-2025-46504 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Olar Marius Vasaio QR Code vasaio-qr-code allows Stored XSS.This issue affects Vasaio QR Code: from n/a thro… |
CVE-2025-46503 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue a… |
CVE-2025-46502 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Matthee LSD Custom taxonomy and category meta custom-… |
CVE-2025-46501 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biancardi Mixcloud Embed mixcloud-embed allows Stored XSS… |
CVE-2025-46499 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder PayPal Express Checkout paypal-express-checkout a… |
CVE-2025-46498 | Medium | 5.4 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in nghialuu Zalo Official Live Chat zalo-official-live-chat allows Cross Site Request Forgery.This issue affect… |
CVE-2025-46497 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Navegg Navegg Analytics navegg allows Stored XSS.This issue affects Navegg Analytics: from n/a through <= 3… |
CVE-2025-46496 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oniswap Mini twitter feed mini-twitter-feed allows Stored… |
CVE-2025-46495 | Medium | 6.5 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through <= 2.1. |
CVE-2025-46492 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Pham Thanh Call Now PHT Blog call-now-coccoc-pht-blog allows Stored XSS.This issue affects Call Now PHT Blog… |
CVE-2025-46491 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Muro Multi-Column Taxonomy List multi-column-taxo… |
CVE-2025-46489 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality… |
CVE-2025-46485 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by… |
CVE-2025-46484 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Image Hover Effects For WPBakery Page Builder… |
CVE-2025-46483 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Peadig’s Google +1 Button google-1 allows DOM-B… |
CVE-2025-46481 | High | 7.2 | 2025-04-24 | Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affect… |
CVE-2025-46480 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Nepali Post Date nepali-post-date allows… |
CVE-2025-46479 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevynCJohnson BBCode Deluxe bbcode-deluxe allows DOM-Base… |
CVE-2025-46478 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored… |
CVE-2025-46477 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-… |
CVE-2025-46476 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Awesome Wp Image Gallery awesome-wp-image-gallery… |
CVE-2025-46475 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson Able Player ableplayer allows DOM-Based XSS.Th… |
CVE-2025-46473 | High | 7.2 | 2025-04-24 | Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a thr… |
CVE-2025-46472 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows… |
CVE-2025-46471 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gnanavelshenll WP Custom Post Popup custom-post-popup all… |
CVE-2025-46470 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in Peter Raschendorfer Smart Hashtags [#hashtagger] hashtagger allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-46469 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Buddle Send From send-from allows Stored XSS.Thi… |
CVE-2025-46467 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahendra Putra K™ RAphicon raphicon allows DOM-Based XSS… |
CVE-2025-46466 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in felixtz Modern Polls modern-polls allows Stored XSS.This issue affects Modern Polls: from n/a through <= 1.0… |
CVE-2025-46465 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in John Weissberg Print Science Designer print-science-designer allows Stored XSS.This issue affects Print Scie… |
CVE-2025-46462 | Medium | 4.3 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Trân Minh-Quân WPVN wpvn-username-changer allows Cross Site Request Forgery.This issue affects WPVN: from n/… |
CVE-2025-46461 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Relentless Apps RRSSB rrssb allows DOM-Based XSS.This iss… |
CVE-2025-46459 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ralf Hortt Confirm User Registration confirm-user-registr… |
CVE-2025-46457 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS… |