2025 CVEs (page 338)
Page 338 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46540 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Mok GNA Search Shortcode gna-search-shortcode allow… |
CVE-2025-46538 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webplanetsoft Inline Text Popup inline-text-popup allows… |
CVE-2025-46536 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RichardHarrison Carousel-of-post-images carousel-of-post-… |
CVE-2025-46534 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DanielRiera Image Style Hover image-content-show-hover al… |
CVE-2025-46533 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress… |
CVE-2025-46532 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Haris Zulfiqar Tooltip wp-tooltip allows DOM-Based XSS.Th… |
CVE-2025-46531 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery… |
CVE-2025-46530 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Attachment hacklog-remote-attachment allows Stored XSS.This issue affects Hack… |
CVE-2025-46529 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StressFree Sites Business Contact Widget business-contact… |
CVE-2025-46528 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Steve Availability Calendar availability allows Stored XSS.This issue affects Availability Calendar: from n/… |
CVE-2025-46525 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in msmitley WP Cookie Consent wp-cookie-consent allows Store… |
CVE-2025-46524 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in stesvis WP Filter Post Category wp-filter-post-categories allows Stored XSS.This issue affects WP Filter Pos… |
CVE-2025-46523 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in devignstudiosltd COVID-19 (Coronavirus) Update Your Custo… |
CVE-2025-46522 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Billy Bryant Tabs gt-tabs allows Stored XSS.This issue affects Tabs: from n/a through <= 4.0.3. |
CVE-2025-46521 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page ws-force-login-page allow… |
CVE-2025-46520 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in alphasis Related Posts via Taxonomies related-posts-via-taxonomies allows Stored XSS.This issue affects Rela… |
CVE-2025-46519 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in M.Code Media Library Downloader media-library-downloader allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-46517 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Blog Manager WP blog-manager-wp allows Stored… |
CVE-2025-46516 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in silencecm Twitter Card Generator twitter-card-generator allows Stored XSS.This issue affects Twitter Card Ge… |
CVE-2025-46514 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in milat Milat jQuery Automatic Popup milat-jquery-automatic-popup allows Stored XSS.This issue affects Milat j… |
CVE-2025-46513 | Medium | 4.3 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite aio-time-clock-lite allows Cross Site Request Forgery.This issue affe… |
CVE-2025-46512 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Shamim Hasan Custom Functions Plugin custom-functions allows Stored XSS.This issue affects Custom Functions… |
CVE-2025-46511 | Medium | 6.4 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects Be… |
CVE-2025-46510 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in harrysudana Contact Form 7 Calendar cf7-calendar allows Stored XSS.This issue affects Contact Form 7 Calenda… |
CVE-2025-46509 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey Mikhalchuk 360 View 360-view allows Stored XSS.Thi… |
CVE-2025-46508 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in kasonzhao Advanced lazy load advanced-lazy-load allows Stored XSS.This issue affects Advanced lazy load: fro… |
CVE-2025-46507 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in ldrumm Unsafe Mimetypes unsafe-mimetypes allows Stored XSS.This issue affects Unsafe Mimetypes: from n/a thr… |
CVE-2025-46506 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliat… |
CVE-2025-46505 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Peekaboo peekaboo allows Stored XSS.This issue… |
CVE-2025-46504 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Olar Marius Vasaio QR Code vasaio-qr-code allows Stored XSS.This issue affects Vasaio QR Code: from n/a thro… |
CVE-2025-46503 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue a… |
CVE-2025-46502 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bas Matthee LSD Custom taxonomy and category meta custom-… |
CVE-2025-46501 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in biancardi Mixcloud Embed mixcloud-embed allows Stored XSS… |
CVE-2025-46499 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hccoder PayPal Express Checkout paypal-express-checkout a… |
CVE-2025-46498 | Medium | 5.4 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in nghialuu Zalo Official Live Chat zalo-official-live-chat allows Cross Site Request Forgery.This issue affect… |
CVE-2025-46497 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Navegg Navegg Analytics navegg allows Stored XSS.This issue affects Navegg Analytics: from n/a through <= 3… |
CVE-2025-46496 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oniswap Mini twitter feed mini-twitter-feed allows Stored… |
CVE-2025-46495 | Medium | 6.5 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in tomontoast Drop Caps drop-caps allows Stored XSS.This issue affects Drop Caps: from n/a through <= 2.1. |
CVE-2025-46492 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Pham Thanh Call Now PHT Blog call-now-coccoc-pht-blog allows Stored XSS.This issue affects Call Now PHT Blog… |
CVE-2025-46491 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matthew Muro Multi-Column Taxonomy List multi-column-taxo… |
CVE-2025-46489 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality… |
CVE-2025-46485 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by… |
CVE-2025-46484 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nasir179125 Image Hover Effects For WPBakery Page Builder… |
CVE-2025-46483 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Moss Peadig’s Google +1 Button google-1 allows DOM-B… |
CVE-2025-46481 | High | 7.2 | 2025-04-24 | Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affect… |
CVE-2025-46480 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Padam Shankhadev Nepali Post Date nepali-post-date allows… |
CVE-2025-46479 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DevynCJohnson BBCode Deluxe bbcode-deluxe allows DOM-Base… |
CVE-2025-46478 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaloha Dropdown Content dropdown-content allows Stored… |
CVE-2025-46477 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-… |
CVE-2025-46476 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nayon46 Awesome Wp Image Gallery awesome-wp-image-gallery… |
CVE-2025-46475 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Dolson Able Player ableplayer allows DOM-Based XSS.Th… |
CVE-2025-46473 | High | 7.2 | 2025-04-24 | Deserialization of Untrusted Data vulnerability in Prisna Social Counter social-counter allows Object Injection.This issue affects Social Counter: from n/a thr… |
CVE-2025-46472 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon The Pack Elementor addons the-pack-addon allows… |
CVE-2025-46471 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gnanavelshenll WP Custom Post Popup custom-post-popup all… |
CVE-2025-46470 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in Peter Raschendorfer Smart Hashtags [#hashtagger] hashtagger allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-46469 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Buddle Send From send-from allows Stored XSS.Thi… |
CVE-2025-46467 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahendra Putra K™ RAphicon raphicon allows DOM-Based XSS… |
CVE-2025-46466 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in felixtz Modern Polls modern-polls allows Stored XSS.This issue affects Modern Polls: from n/a through <= 1.0… |
CVE-2025-46465 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in John Weissberg Print Science Designer print-science-designer allows Stored XSS.This issue affects Print Scie… |
CVE-2025-46462 | Medium | 4.3 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Trân Minh-Quân WPVN wpvn-username-changer allows Cross Site Request Forgery.This issue affects WPVN: from n/… |
CVE-2025-46461 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Relentless Apps RRSSB rrssb allows DOM-Based XSS.This iss… |
CVE-2025-46459 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ralf Hortt Confirm User Registration confirm-user-registr… |
CVE-2025-46457 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Ahsanullah Akanda Wp Custom CMS Block wp-custom-cms-block allows Stored XSS.This issue affects Wp Custom CMS… |
CVE-2025-46453 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreatorTeam Zoho Creator Forms allows Stored XSS. This is… |
CVE-2025-46452 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Olav Kolbu Google News allows Stored XSS. This issue affects Google News: from n/a through 2.5.1. |
CVE-2025-46451 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allow… |
CVE-2025-46450 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows Stored XSS.This issue affects occupancyplan: from n/a through <= 1… |
CVE-2025-46449 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Novium WoWHead Tooltips wowhead-tooltips allows Stored XS… |
CVE-2025-46447 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFable Fable Extra fable-extra allows DOM-Based XSS.This… |
CVE-2025-46445 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pReya External Markdown external-markdown allows Stored X… |
CVE-2025-46443 | Medium | 4.9 | 2025-04-24 | Server-Side Request Forgery (SSRF) vulnerability in Adam Pery Animate animate allows Server Side Request Forgery.This issue affects Animate: from n/a through <… |
CVE-2025-46442 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: fro… |
CVE-2025-46439 | High | 7.4 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Vladimir Prelovac Plugin Central plugin-central allows Path Traversal.This issue affects Plugin Central: fro… |
CVE-2025-46438 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in warmwhisky GTDB Guitar Tuners guitar-tuner allows Stored… |
CVE-2025-46436 | Medium | 4.3 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Sebastian Echeverry SCSS-Library scss-library allows Cross Site Request Forgery.This issue affects SCSS-Libr… |
CVE-2025-46435 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Yash Binani Time Based Greeting time-based-greeting allows Stored XSS.This issue affects Time Based Greeting… |
CVE-2025-46264 | Critical | 9.9 | 2025-04-24 | Unrestricted Upload of File with Dangerous Type vulnerability in blubrry PowerPress Podcasting powerpress allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-46261 | Medium | 5.9 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple… |
CVE-2025-46260 | Medium | 6.5 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wowDevs Sky Addons for Elementor sky-elementor-addons all… |
CVE-2025-46248 | Critical | 9.3 | 2025-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard al… |
CVE-2025-46234 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Razib Control Listings control-listings al… |
CVE-2025-46230 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GhozyLab Popup Builder easy-notify-lit… |
CVE-2025-39408 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EverPress BruteGuard – Brute Force Login Protection brute… |
CVE-2025-39404 | Medium | 4.7 | 2025-04-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Phishing.This issue affects S… |
CVE-2025-39400 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpeverest User Registration user-registration allows Refl… |
CVE-2025-39399 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashraful Sarkar Naiem License For Enva… |
CVE-2025-39397 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Anything Popup anything-popup allows… |
CVE-2025-39391 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for… |
CVE-2025-39390 | Medium | 5.3 | 2025-04-24 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Accessing Functionality Not… |
CVE-2025-39387 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpoperations Opstore opstore allows PH… |
CVE-2025-39385 | Medium | 4.3 | 2025-04-24 | Missing Authorization vulnerability in vowelweb Sirat sirat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sirat: f… |
CVE-2025-39384 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce Product Lister for eBay pr… |
CVE-2025-39383 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb Xews Lite xews-lite allows… |
CVE-2025-39382 | High | 7.1 | 2025-04-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in danielpataki ACF: Google Font Selector acf-google-font-se… |
CVE-2025-39381 | High | 7.1 | 2025-04-24 | Cross-Site Request Forgery (CSRF) vulnerability in Kiotviet KiotViet Sync allows Stored XSS. This issue affects KiotViet Sync: from n/a through 1.8.4. |
CVE-2025-39379 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Capturly Capturly capturly-optimize-yo… |
CVE-2025-39378 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Holest Engineering Spreadsheet Price C… |
CVE-2025-39377 | High | 8.5 | 2025-04-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in weDevs Appsero Helper appsero-helper allows SQL Injection… |
CVE-2025-39360 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in everestthemes Grace Mag grace-mag allo… |
CVE-2025-39359 | High | 7.5 | 2025-04-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb CWW Portfolio cww-portfoli… |