2025 CVEs (page 342)
Page 342 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39453 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Si… |
CVE-2025-39452 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Lo… |
CVE-2025-39444 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This i… |
CVE-2025-39443 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through… |
CVE-2025-39442 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This i… |
CVE-2025-39441 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Dashboard Notepads dashboard-notepads allows Stored XSS.This issue affects Dashboard Notepads: f… |
CVE-2025-39440 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover… |
CVE-2025-39439 | Medium | 5.3 | 2025-04-17 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensit… |
CVE-2025-39438 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in momen2009 Theme Changer theme-changer allows Cross Site Request Forgery.This issue affects Theme Changer: fr… |
CVE-2025-39437 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from… |
CVE-2025-39436 | Critical | 9.1 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <… |
CVE-2025-39435 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in davidfcarr My Marginalia my-marginalia allows Stored XSS.This issue affects My Marginalia: from n/a through… |
CVE-2025-39434 | Medium | 4.3 | 2025-04-17 | Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-39433 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in beke_ro Bknewsticker bknewsticker allows Stored XSS.This issue affects Bknewsticker: from n/a through <= 1.0… |
CVE-2025-39432 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in antonchanning bbPress2 shortcode whitelist bbpress2-short… |
CVE-2025-39431 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue… |
CVE-2025-39430 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Alexander Rauscha mLanguage mlanguage allows Stored XSS.This issue affects mLanguage: from n/a through <= 1… |
CVE-2025-39429 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Földesi, Mihály Széchenyi 2020 Logo sz… |
CVE-2025-39428 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maros Pristas Gravity Forms CSS Themes with Fontawesome a… |
CVE-2025-39427 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Beth Tucker Long WP Post to PDF Enhanced wp-post-to-pdf-e… |
CVE-2025-39426 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in illow illow – Cookies Consent lgpd-compliant-cookie-banner allows Cross Site Request Forgery.This issue affe… |
CVE-2025-39425 | Medium | 4.3 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in pixelgrade Style Manager style-manager allows Cross Site Request Forgery.This issue affects Style Manager: f… |
CVE-2025-39424 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in simplemaps Simple Maps interactive-maps allows Stored XSS.This issue affects Simple Maps: from n/a through <… |
CVE-2025-39423 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Jenst Add to Header add-to-header allows Stored XSS.This issue affects Add to Header: from n/a through <= 1… |
CVE-2025-39422 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in PResponsive WP Social Bookmarking wp-social-bookmarking allows Stored XSS.This issue affects WP Social Bookm… |
CVE-2025-39421 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Mustafa KUCUK WP Sticky Side Buttons wp-sticky-side-buttons allows Stored XSS.This issue affects WP Sticky S… |
CVE-2025-39420 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ruudkok WP Twitter Button wp-twitter-button allows Stored… |
CVE-2025-39419 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in David Miller Revision Diet revision-diet allows Stored XSS.This issue affects Revision Diet: from n/a throug… |
CVE-2025-39418 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in ajayver RSS Manager rss-manager allows Stored XSS.This issue affects RSS Manager: from n/a through <= 0.06. |
CVE-2025-39417 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Eslam Mahmoud Redirect wordpress to welcome or landing page redirect-to-welcome-or-landing-page allows Store… |
CVE-2025-39416 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Ichi translit it! translit-it allows Stored XSS.This issue affects translit it!: from n/a through <= 1.6. |
CVE-2025-39415 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Jayesh Parejiya Social Media Links social-media-links allows Stored XSS.This issue affects Social Media Link… |
CVE-2025-39414 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Mike spam-stopper spam-stopper allows Stored XSS.This issue affects spam-stopper: from n/a through <= 3.1.3. |
CVE-2025-32686 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in WPSpeedo Team Members wps-team allows Object Injection.This issue affects Team Members: from n/a through <=… |
CVE-2025-32682 | Critical | 9.9 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows Upload a Web Shell to a Web Server… |
CVE-2025-32674 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Product Excel Import Export & Bulk Edit for Woo… |
CVE-2025-32670 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark Parnell Spark GF Failed Submissions spark-gf-failed-… |
CVE-2025-32666 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hive Support Hive Support hive-support allows Reflected X… |
CVE-2025-32665 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WebbyTemplate Office Locator office-locator allows SQL In… |
CVE-2025-32662 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Stylemix uListing ulisting allows Object Injection.This issue affects uListing: from n/a through <= 2.2.0. |
CVE-2025-32660 | Critical | 10.0 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in JoomSky JS Job Manager js-jobs allows Upload a Web Shell to a Web Server.This issue affects JS… |
CVE-2025-32658 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in wpWax HelpGent helpgent allows Object Injection.This issue affects HelpGent: from n/a through <= 2.2.5. |
CVE-2025-32655 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in DevriX Restrict User Registration restrict-user-registration allows Stored XSS.This issue affects Restrict U… |
CVE-2025-32653 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lee Blue Cart66 Cloud cart66-cloud allows Reflected XSS.T… |
CVE-2025-32652 | Critical | 9.9 | 2025-04-17 | Unrestricted Upload of File with Dangerous Type vulnerability in solacewp Solace Extra solace-extra allows Using Malicious Files.This issue affects Solace Extr… |
CVE-2025-32651 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in serpednet SERPed.net serped-net allows Reflected XSS.This… |
CVE-2025-32649 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allo… |
CVE-2025-32648 | Critical | 9.8 | 2025-04-17 | Incorrect Privilege Assignment vulnerability in Projectopia Projectopia projectopia-core allows Privilege Escalation.This issue affects Projectopia: from n/a t… |
CVE-2025-32647 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in PickPlugins Question Answer question-answer allows Object Injection.This issue affects Question Answer: from… |
CVE-2025-32646 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Question Answer question-answer allows Reflec… |
CVE-2025-32639 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wecantrack Affiliate Links Lite affiliate-links allows Re… |
CVE-2025-32638 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weptile Mobile App for WooCommerce mobile-app-for-woocomm… |
CVE-2025-32637 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ketanajani WP Donate wp-donate allows Stored XSS.This iss… |
CVE-2025-32636 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in matthewrubin Local Magic local-magic allows SQL Injection… |
CVE-2025-32635 | High | 7.5 | 2025-04-17 | Insertion of Sensitive Information Into Sent Data vulnerability in Hive Support Hive Support hive-support allows Retrieve Embedded Sensitive Data.This issue af… |
CVE-2025-32634 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mdedev Run Contests, Raffles, and Giveaways with Contests… |
CVE-2025-32630 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-Busin… |
CVE-2025-32628 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Crowdfunding for WooCommerce crowdfunding-for-woo… |
CVE-2025-32626 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Job Manager js-jobs allows SQL Injection.This… |
CVE-2025-32625 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pootlepress Mobile Pages mobile-pages allows Reflected XS… |
CVE-2025-32622 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTP-less OTP-less one tap Sign in otpless allows Reflecte… |
CVE-2025-32620 | High | 7.1 | 2025-04-17 | Missing Authorization vulnerability in fromdoppler Doppler Forms doppler-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-32615 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clinked Clinked Client Portal clinked-client-portal allow… |
CVE-2025-32613 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bowo Debug Log Manager debug-log-manager allows Stored XS… |
CVE-2025-32611 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in We Are De WooCommerce TBC Credit Card Payment Gateway (Fr… |
CVE-2025-32609 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Picture-Planet GmbH Verowa Connect verowa-connect allows… |
CVE-2025-32608 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Movylo Movylo Marketing Automation movylo-widget allows R… |
CVE-2025-32606 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in Deepak Khokhar Listings for Buildium listings-for-buildium allows Stored XSS.This issue affects Listings for… |
CVE-2025-32605 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in expresstechsoftware MemberPress Discord Addon expresstech… |
CVE-2025-32604 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sajjad Aslani AWSA Shipping awsa-shipping allows Reflecte… |
CVE-2025-32602 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcraft WooMS wooms allows Reflected XSS.This issue affec… |
CVE-2025-32596 | High | 7.3 | 2025-04-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Code Injection.This issu… |
CVE-2025-32594 | High | 7.5 | 2025-04-17 | Insertion of Sensitive Information Into Sent Data vulnerability in WPMinds Simple WP Events simple-wp-events allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-32593 | High | 8.2 | 2025-04-17 | Missing Authorization vulnerability in Bytes Technolab Add Product Frontend for WooCommerce add-product-frontend-for-woocommerce allows Exploiting Incorrectly… |
CVE-2025-32592 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Stored X… |
CVE-2025-32590 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tzin111 Web2application web2application allows Reflected… |
CVE-2025-32588 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Credova Financial Credova_Financial credova-financial all… |
CVE-2025-32583 | Critical | 9.9 | 2025-04-17 | Improper Control of Generation of Code ('Code Injection') vulnerability in termel PDF 2 Post pdf2post allows Remote Code Inclusion.This issue affects PDF 2 Pos… |
CVE-2025-32582 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allo… |
CVE-2025-32578 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mapro Collins Coming Soon Countdown coming-soon-countdown… |
CVE-2025-32573 | High | 8.5 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kiotviet KiotViet Sync allows SQL Injection. This issue a… |
CVE-2025-32572 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Climax Themes Kata Plus kata-plus allows Object Injection.This issue affects Kata Plus: from n/a through <=… |
CVE-2025-32571 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in TuriTop TuriTop Booking System turitop-booking-system allows Object Injection.This issue affects TuriTop Boo… |
CVE-2025-32566 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashraful Sarkar Naiem License For Envato license-envato a… |
CVE-2025-32564 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tomroyal Stop Registration Spam allows Reflected XSS. Thi… |
CVE-2025-32562 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com WP Easy Poll wp-easy-poll-afo allows Refle… |
CVE-2025-32561 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plugins.club WP_DEBUG Toggle enable-wp-debug-toggle allow… |
CVE-2025-32560 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohammad I. Okfie WP-Hijri wp-hijri allows Reflected XSS… |
CVE-2025-32557 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rico Macchi WP Featured Screenshot wp-featured-screenshot… |
CVE-2025-32554 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Raptive Raptive Ads adthrive-ads allows Reflected XSS.Thi… |
CVE-2025-32552 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory MSRP (RRP) Pricing for WooCommerce msrp-for-woo… |
CVE-2025-32548 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in borisolhor Hamburger Icon Menu Lite allows Reflected XSS… |
CVE-2025-32546 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in gtlwpdev All push notification for WP all-push-notification allows Reflected XSS.This issue affects All push… |
CVE-2025-32545 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in SOFTAGON WooCommerce Products without featured images woocommerce-products-without-featured-images allows Re… |
CVE-2025-32544 | High | 7.5 | 2025-04-17 | Missing Authorization vulnerability in The Right Software WooCommerce Loyal Customers woocommerce-loyal-customer allows Accessing Functionality Not Properly Co… |
CVE-2025-32540 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in feedify Feedify – Web Push Notifications push-notificatio… |
CVE-2025-32535 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digireturn DN Shipping by Weight for WooCommerce dn-shipp… |
CVE-2025-32533 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matat Technologies Deliver via Shipos for WooCommerce wc-… |
CVE-2025-32532 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pei Yong Goh UXsniff ux-sniff allows Reflected XSS.This i… |
CVE-2025-32531 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Reflected X… |