2025 CVEs (page 354)
Page 354 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32570 | High | 7.1 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ChillPay ChillPay WooCommerce chillpay-payment-gateway al… |
CVE-2025-32563 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in dangrossman WP Calais Auto Tagger calais-auto-tagger allows Cross Site Request Forgery.This issue affects WP… |
CVE-2025-32559 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in REVE Chat REVE Chat revechat allows Stored XSS.This issue affects REVE Chat: from n/a through <= 6.4.4. |
CVE-2025-32556 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Sandor Kovacs Simple Post Meta Manager simple-post-meta-manager allows Reflected XSS.This issue affects Simp… |
CVE-2025-32555 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Edamam SEO, Nutrition and Print for Recipes by Edamam seo-nutrition-and-print-for-recipes-by-edamam allows S… |
CVE-2025-32550 | High | 7.2 | 2025-04-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect Plugin allows SQL I… |
CVE-2025-32547 | High | 8.2 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in gtlwpdev All push notification for WP all-push-notification allows Blind SQL Injection.This issue affects Al… |
CVE-2025-32543 | High | 7.1 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hivedigital Canonical Attachments canonical-attachments a… |
CVE-2025-32518 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in hossainawlad ALD Login Page ald-login-page allows Stored XSS.This issue affects ALD Login Page: from n/a thr… |
CVE-2025-32505 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in SCAND MultiMailer scand-multi-mailer allows Stored XSS.This issue affects MultiMailer: from n/a through <= 1… |
CVE-2025-32503 | High | 7.1 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Conti Link Shield link-shield allows Stored XSS.This… |
CVE-2025-32502 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in lemmentwickler ePaper Lister for Yumpu magazine-lister-for-yumpu allows Stored XSS.This issue affects ePaper… |
CVE-2025-32501 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in dimafreund Rentsyst rentsyst allows Stored XSS.This issue affects Rentsyst: from n/a through <= 2.0.92. |
CVE-2025-32500 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Sudavar Codescar Radio Widget codescar-radio-widget allows Stored XSS.This issue affects Codescar Radio Widg… |
CVE-2025-32499 | Medium | 6.5 | 2025-04-09 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Logo Showcase Ultimate logo-show… |
CVE-2025-32498 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in oleglark VKontakte Cross-Post vkontakte-cross-post allows Stored XSS.This issue affects VKontakte Cross-Post… |
CVE-2025-32497 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in squiter Spoiler Block spoiler-block allows Stored XSS.This issue affects Spoiler Block: from n/a through <=… |
CVE-2025-32496 | Critical | 9.6 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Uncodethemes Ultra Demo Importer ut-demo-importer allows Upload a Web Shell to a Web Server.This issue affec… |
CVE-2025-32495 | Medium | 6.5 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Waymark waymark allows Stored XSS.This issue affects… |
CVE-2025-32494 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in bozdoz reCAPTCHA Jetpack recaptcha-jetpack allows Cross Site Request Forgery.This issue affects reCAPTCHA Je… |
CVE-2025-32493 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VibeThemes BP Social Connect bp-social-connect allows Sto… |
CVE-2025-32492 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eliot Akira Admin Menu Post List admin-menu-post-list all… |
CVE-2025-32489 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tim Wetterwarner wetterwarner allows Stored XSS.This issu… |
CVE-2025-32488 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in آریا وردپرس Aria Font aria-font allows Stored XSS.This is… |
CVE-2025-32487 | Medium | 4.9 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in Joe Waymark waymark allows Server Side Request Forgery.This issue affects Waymark: from n/a through <= 1.5… |
CVE-2025-32485 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Cross Site Request Forgery.This issue affects WP Perfo… |
CVE-2025-32484 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WP-Planification wp-planification allows Stored XSS.This issue affects WP-Planification: fr… |
CVE-2025-32483 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Salisbury Request Call Back request-call-back allow… |
CVE-2025-32482 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in quanganhdo Custom Smilies custom-smilies allows Stored XSS.This issue affects Custom Smilies: from n/a throu… |
CVE-2025-32481 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in ninotheme Nino Social Connect nino-social-connect allows Stored XSS.This issue affects Nino Social Connect… |
CVE-2025-32480 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in dalziel Windows Live Writer windows-live-writer allows Stored XSS.This issue affects Windows Live Writer: fr… |
CVE-2025-32479 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in ab-tools Flags Widget flags-widget allows Stored XSS.This issue affects Flags Widget: from n/a through <= 1… |
CVE-2025-32478 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Mario Aguiar WP SexyLightBox wp-sexylightbox allows Stored XSS.This issue affects WP SexyLightBox: from n/a… |
CVE-2025-32477 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Jordi Salord WP-Easy Menu wp-easy-menu allows Stored XSS.This issue affects WP-Easy Menu: from n/a through <… |
CVE-2025-32476 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in blueinstyle Advanced Tag Lists advanced-tag-list allows Stored XSS.This issue affects Advanced Tag Lists: fr… |
CVE-2025-31404 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Wladyslaw Madejczyk AF Tell a Friend af-tell-a-friend allows Stored XSS.This issue affects AF Tell a Friend… |
CVE-2025-31402 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in NewsBoard Plugin NewsBoard Post and RSS Scroller newsboard allows Stored XSS.This issue affects NewsBoard Po… |
CVE-2025-31401 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in mmetrodw MMX – Make Me Christmas mmx-make-me-christmas allows Stored XSS.This issue affects MMX – Make Me Ch… |
CVE-2025-31400 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in icyleaf WS Audio Player ws-audio-player allows Stored XSS.This issue affects WS Audio Player: from n/a throu… |
CVE-2025-31399 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Chandan Garg CG Scroll To Top cg-scroll-to-top allows Stored XSS.This issue affects CG Scroll To Top: from n… |
CVE-2025-31395 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in a.ankit Easy Custom CSS easy-custom-css allows Stored XSS.This issue affects Easy Custom CSS: from n/a throu… |
CVE-2025-31394 | High | 7.1 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey (trepmal) More Mime Type Filters more-mime-type-fi… |
CVE-2025-31393 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in vfvalent Social Bookmarking RELOADED social-bookmarking-reloaded allows Stored XSS.This issue affects Social… |
CVE-2025-31392 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Shameem Reza Smart Product Gallery Slider smart-product-gallery-slider allows Cross Site Request Forgery.Thi… |
CVE-2025-31391 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in regen Script Compressor script-compressor allows Stored XSS.This issue affects Script Compressor: from n/a t… |
CVE-2025-31390 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in bdoga Social Crowd social-crowd allows Stored XSS.This issue affects Social Crowd: from n/a through <= 0.9.6… |
CVE-2025-31388 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in doa The World the-world allows Stored XSS.This issue affects The World: from n/a through <= 0.4. |
CVE-2025-31385 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in intelcaprep Site Table of Contents site-table-of-contents allows Stored XSS.This issue affects Site Table of… |
CVE-2025-31383 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in sodena FrescoChat Live Chat flexytalk-widget allows Stored XSS.This issue affects FrescoChat Live Chat: from… |
CVE-2025-31382 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in theode Language Field language-field allows Stored XSS.This issue affects Language Field: from n/a through <… |
CVE-2025-31377 | High | 7.5 | 2025-04-09 | Missing Authorization vulnerability in Asaquzzaman mishu Woo Product Feed For Marketing Channels woocommerce-to-google-merchant-center allows Exploiting Incorr… |
CVE-2025-31375 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in bhoogterp Scheduled scheduled allows Stored XSS.This issue affects Scheduled: from n/a through <= 1.0. |
CVE-2025-31042 | Medium | 5.3 | 2025-04-09 | Missing Authorization vulnerability in rtakao Sandwich Adsense firsth3tagadsense allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-31038 | High | 8.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Essential Marketer Essential Breadcrumbs essential-breadcrumbs allows Privilege Escalation.This issue affect… |
CVE-2025-31036 | High | 8.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in WPSOLR WPSolr wpsolr-free allows Privilege Escalation.This issue affects WPSolr: from n/a through <= 24.0. |
CVE-2025-31035 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Chris WP Editor.md – The Perfect WordPress Markd… |
CVE-2025-31034 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in AboZain Albanna Customize Login Page customize-login-page allows Cross Site Request Forgery.This issue affec… |
CVE-2025-31033 | Critical | 9.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Adam Nowak Buddypress Humanity buddypress-humanity allows Cross Site Request Forgery.This issue affects Budd… |
CVE-2025-31032 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Pagopar - Grupo M S.A. Pagopar – WooCommerce Gateway pagopar-woocommerce-gateway allows Stored XSS.This issu… |
CVE-2025-31026 | High | 7.1 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Austin Comment Validation Reloaded comment-validation-reloaded allows Stored XSS.This issue affects Comment… |
CVE-2025-31023 | High | 8.8 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Purab Seo Meta Tags seo-meta-tags allows Cross Site Request Forgery.This issue affects Seo Meta Tags: from n… |
CVE-2025-31020 | Medium | 6.5 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webliberty Simple Spoiler simple-spoiler allows Stored XS… |
CVE-2025-31017 | Medium | 6.5 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Noakes Nav Menu Manager noakes-menu-manager allows… |
CVE-2025-31012 | Medium | 5.3 | 2025-04-09 | Missing Authorization vulnerability in Phil Age Gate age-gate allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Age Gate: from… |
CVE-2025-31009 | Medium | 5.4 | 2025-04-09 | Server-Side Request Forgery (SSRF) vulnerability in Jan Boddez IndieBlocks indieblocks allows Server Side Request Forgery.This issue affects IndieBlocks: from… |
CVE-2025-31008 | Medium | 5.9 | 2025-04-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Embeds For YouTube Plugin Support YouTube Embed youtube-e… |
CVE-2025-31005 | Medium | 4.3 | 2025-04-09 | Cross-Site Request Forgery (CSRF) vulnerability in Uzair Easyfonts easyfonts allows Cross Site Request Forgery.This issue affects Easyfonts: from n/a through <… |
CVE-2025-31004 | Medium | 4.3 | 2025-04-09 | Missing Authorization vulnerability in Croover.inc Rich Table of Contents rich-table-of-content allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-31003 | Low | 2.7 | 2025-04-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze squeeze allows Retrieve Embedded Sensitiv… |
CVE-2025-31002 | Critical | 9.1 | 2025-04-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze squeeze allows Using Malicious Files.This issue affects Squeeze: fro… |
CVE-2025-32381 | Medium | 6.5 | 2025-04-09 | XGrammar is an open-source library for efficient, flexible, and portable structured generation. Prior to 0.1.18, Xgrammar includes a cache for compiled grammar… |
CVE-2025-32380 | High | 7.5 | 2025-04-09 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerab… |
CVE-2025-32379 | Medium | 5.0 | 2025-04-09 | Koa is expressive middleware for Node.js using ES2017 async functions. In koa < 2.16.1 and < 3.0.0-alpha.5, passing untrusted user input to ctx.redirect() even… |
CVE-2025-32378 | Medium | 5.3 | 2025-04-09 | Shopware is an open source e-commerce software platform. Prior to 6.6.10.3 or 6.5.8.17, the default settings for double-opt-in allow for mass unsolicited newsl… |
CVE-2025-32375 | Critical | 9.8 | 2025-04-09 | BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserializatio… |
CVE-2025-32374 | Medium | 5.9 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Possible denial of service with specially crafted… |
CVE-2025-32373 | Medium | 6.5 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. In limited configurations, registered users may b… |
CVE-2025-32372 | Medium | 6.5 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A bypass has been identified for the previously k… |
CVE-2025-32371 | Medium | 4.3 | 2025-04-09 | DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. A url could be crafted to the DNN ImageHandler to… |
CVE-2025-32016 | Medium | 4.7 | 2025-04-09 | Microsoft Identity Web is a library which contains a set of reusable classes used in conjunction with ASP.NET Core for integrating with the Microsoft identity… |
CVE-2025-29394 | High | 8.1 | 2025-04-09 | An insecure permissions vulnerability in verydows v2.0 allows a remote attacker to execute arbitrary code by uploading a file type. |
CVE-2025-29391 | High | 7.2 | 2025-04-09 | horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php. |
CVE-2025-29390 | High | 8.8 | 2025-04-09 | jerryhanjj ERP 1.0 is vulnerable to SQL Injection in the set_password function in application/controllers/home.php. |
CVE-2025-29389 | Medium | 6.1 | 2025-04-09 | PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2#tab=t2. |
CVE-2025-27391 | Medium | 6.5 | 2025-04-09 | Insertion of Sensitive Information into Log File vulnerability in Apache ActiveMQ Artemis. All the values of the broker properties are logged when the org.apac… |
CVE-2025-25023 | Medium | 4.9 | 2025-04-09 | IBM Security Guardium 11.4 and 12.1 could allow a privileged user to read any file on the system due to incorrect privilege assignment. |
CVE-2025-1968 | High | 7.7 | 2025-04-09 | Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under some specific and uncommon circumstances allows reusing Session… |
CVE-2025-31672 | Medium | 5.3 | 2025-04-09 | Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are bas… |
CVE-2025-30677 | Medium | 6.5 | 2025-04-09 | Apache Pulsar contains multiple connectors for integrating with Apache Kafka. The Pulsar IO Apache Kafka Source Connector, Sink Connector, and Kafka Connect Ad… |
CVE-2025-29189 | High | 7.6 | 2025-04-09 | Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores. |
CVE-2025-2442 | Medium | 6.8 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could potentially lead to unauthorized access which could result in t… |
CVE-2025-2441 | Medium | 4.6 | 2025-04-09 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having p… |
CVE-2025-2440 | Medium | 4.2 | 2025-04-09 | CWE-922: Insecure Storage of Sensitive Information vulnerability exists that could potentially lead to unauthorized access of confidential data when a maliciou… |
CVE-2025-2223 | High | 7.8 | 2025-04-09 | CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a… |
CVE-2025-2222 | High | 7.8 | 2025-04-09 | CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak information and potential privilege escalation fol… |
CVE-2025-29870 | High | 7.5 | 2025-04-09 | Missing authentication for critical function vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote unauthenticated attacker may ob… |
CVE-2025-27934 | High | 7.5 | 2025-04-09 | Information disclosure of authentication information in the specific service vulnerability exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a remote… |
CVE-2025-27797 | Critical | 9.8 | 2025-04-09 | OS command injection vulnerability in the specific service exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, an arbitrary OS command may be executed… |
CVE-2025-27722 | Medium | 5.9 | 2025-04-09 | Cleartext transmission of sensitive information issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If exploited, a man-in-the-middle attack may allow a remote… |
CVE-2025-25213 | Medium | 6.5 | 2025-04-09 | Improper restriction of rendered UI layers or frames issue exists in Wi-Fi AP UNIT 'AC-WPS-11ac series'. If a user views and clicks on the content on the malic… |