2025 CVEs (page 360)
Page 360 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32358 | Medium | 4.0 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, SSRF can occur. Authenticated admin users can enable webhooks in Zammad, which are triggered as POST requests when certain condit… |
CVE-2025-32357 | Medium | 4.3 | 2025-04-05 | In Zammad 6.4.x before 6.4.2, an authenticated agent with knowledge base permissions was able to use the Zammad API to fetch knowledge base content that they h… |
CVE-2025-30401 | Medium | 6.7 | 2025-04-05 | A spoofing issue in WhatsApp for Windows prior to version 2.2450.6 displayed attachments according to their MIME type but selected the file opening handler bas… |
CVE-2025-3299 | High | 7.3 | 2025-04-05 | A vulnerability was found in PHPGurukul Men Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-3298 | Medium | 4.3 | 2025-04-05 | A vulnerability has been found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. Affected by this vulnerability is an unknown functional… |
CVE-2025-3297 | Low | 3.5 | 2025-04-05 | A vulnerability, which was classified as problematic, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes… |
CVE-2025-3296 | Medium | 6.3 | 2025-04-05 | A vulnerability, which was classified as critical, has been found in SourceCodester Online Eyewear Shop 1.0. This issue affects some unknown processing of the… |
CVE-2025-2941 | Critical | 9.8 | 2025-04-05 | The Drag and Drop Multiple File Upload for WooCommerce plugin for WordPress is vulnerable to arbitrary file moving due to insufficient file path validation via… |
CVE-2025-2789 | Medium | 5.3 | 2025-04-05 | The MultiVendorX – Empower Your WooCommerce Store with a Dynamic Multivendor Marketplace – Build the Next Amazon, eBay, Etsy plugin for WordPress is vulnerable… |
CVE-2025-1233 | Medium | 4.3 | 2025-04-05 | The Lafka Plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'lafka_options_upload' AJAX function in all versio… |
CVE-2025-0839 | Medium | 6.4 | 2025-04-05 | The ZoomSounds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 6.91 due to insufficient inpu… |
CVE-2025-32352 | Medium | 4.8 | 2025-04-05 | A type confusion vulnerability in lib/NSSAuthenticator.php in ZendTo before v5.04-7 allows remote attackers to bypass authentication for users with passwords s… |
CVE-2025-2933 | High | 8.8 | 2025-04-05 | The Email Notifications for Updates plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a miss… |
CVE-2025-2544 | Medium | 6.4 | 2025-04-05 | The AI Content Pipelines plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.6 due t… |
CVE-2025-0810 | High | 7.5 | 2025-04-05 | The Read More & Accordion plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.7. This is due to missing… |
CVE-2025-1500 | Medium | 5.5 | 2025-04-05 | IBM Maximo Application Suite 9.0 could allow an authenticated user to upload a file with dangerous types that could be executed by another user if opened. |
CVE-2025-2889 | Medium | 6.4 | 2025-04-05 | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Link Additional Parameters in all versions up to, and including, 7.7… |
CVE-2025-3268 | Medium | 5.3 | 2025-04-04 | A vulnerability has been found in qinguoyi TinyWebServer up to 1.0 and classified as critical. This vulnerability affects unknown code of the file http/http_co… |
CVE-2025-3267 | Medium | 6.3 | 2025-04-04 | A vulnerability, which was classified as critical, was found in qinguoyi TinyWebServer up to 1.0. This affects an unknown part of the file /http/http_conn.cpp… |
CVE-2025-3266 | High | 7.3 | 2025-04-04 | A vulnerability, which was classified as critical, has been found in qinguoyi TinyWebServer up to 1.0. Affected by this issue is some unknown functionality of… |
CVE-2025-3265 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical was found in PHPGurukul e-Diary Management System 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-3259 | High | 8.8 | 2025-04-04 | A vulnerability, which was classified as critical, has been found in Tenda RX3 16.03.13.11. This issue affects the function formSetDeviceName of the file /gofo… |
CVE-2025-29477 | Medium | 5.5 | 2025-04-04 | An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the function consume_event. |
CVE-2025-29476 | Medium | 5.5 | 2025-04-04 | Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before. |
CVE-2025-3258 | High | 7.3 | 2025-04-04 | A vulnerability classified as critical was found in PHPGurukul Old Age Home Management System 1.0. This vulnerability affects unknown code of the file /search… |
CVE-2025-3257 | Medium | 4.3 | 2025-04-04 | A vulnerability classified as problematic has been found in xujiangfei admintwo 1.0. This affects an unknown part of the file /user/updateSet. The manipulation… |
CVE-2025-3256 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /user/upd… |
CVE-2025-3255 | Medium | 4.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-3254 | Medium | 6.3 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0. It has been classified as critical. Affected is an unknown function of the file /resource/add. The manipu… |
CVE-2025-3253 | Low | 3.5 | 2025-04-04 | A vulnerability was found in xujiangfei admintwo 1.0 and classified as problematic. This issue affects some unknown processing of the file /ztree/insertTree. T… |
CVE-2025-3252 | Low | 3.5 | 2025-04-04 | A vulnerability has been found in xujiangfei admintwo 1.0 and classified as problematic. This vulnerability affects unknown code of the file /resource/add. The… |
CVE-2025-32280 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in weDevs WP Project Manager wedevs-project-manager allows Cross Site Request Forgery.This issue affects WP Pro… |
CVE-2025-32278 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in wprio Table Block by RioVizual riovizual allows Cross Site Request Forgery.This issue affects Table Block by… |
CVE-2025-32277 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-32276 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Quý Lê 91 Administrator Z administrator-z allows Cross Site Request Forgery.This issue affects Administrator… |
CVE-2025-32274 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in axew3 WP w3all phpBB wp-w3all-phpbb-integration allows Cross Site Request Forgery.This issue affects WP w3al… |
CVE-2025-32273 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in freetobook Freetobook Responsive Widget freetobook-responsive-widget allows Cross Site Request Forgery.This… |
CVE-2025-32272 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Wishlist wishlist allows Cross Site Request Forgery.This issue affects Wishlist: from n/a throug… |
CVE-2025-32271 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in ablancodev Woocommerce Role Pricing woocommerce-role-pricing allows Cross Site Request Forgery.This issue af… |
CVE-2025-32270 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Broadstreet Broadstreet Ads broadstreet allows Cross Site Request Forgery.This issue affects Broadstreet Ads… |
CVE-2025-32269 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms cf7-zendesk allows C… |
CVE-2025-32268 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in www.15.to QR Code Tag for WC qr-code-tag-for-wc-from-goaskle-com allows Cross Site Request Forgery.This issu… |
CVE-2025-32267 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in wpzinc Post to Social Media – WordPress to Hootsuite wp-to-hootsuite allows Cross Site Request Forgery.This… |
CVE-2025-32266 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in wp-buy 404 Image Redirection (Replace Broken Images) broken-images-redirection allows Cross Site Request For… |
CVE-2025-32265 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak JobWP jobwp allows Cross Site Request Forgery.This issue affects JobWP: from n/a through <= 2… |
CVE-2025-32264 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Cross Site Request Forgery.This is… |
CVE-2025-32263 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in BeRocket Sequential Order Numbers for WooCommerce sequential-order-numbers-for-woocommerce allows Cross Site… |
CVE-2025-32262 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Robert D Payne RDP Wiki Embed rdp-wiki-embed allows Cross Site Request Forgery.This issue affects RDP Wiki E… |
CVE-2025-32261 | Medium | 4.3 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Kuppuraj Advanced All in One Admin Search by WP Spotlight wp-spotlight-search allows Cross Site Request Forg… |
CVE-2025-32258 | Medium | 5.3 | 2025-04-04 | Missing Authorization vulnerability in InfoGiants Simple Website Logo simple-website-logo allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-32257 | Medium | 5.3 | 2025-04-04 | Exposure of Sensitive System Information Due to Uncleared Debug Information vulnerability in 1clickmigration 1 Click WordPress Migration 1-click-migration allo… |
CVE-2025-32256 | Medium | 5.3 | 2025-04-04 | Missing Authorization vulnerability in devsoftbaltic SurveyJS surveyjs allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Surve… |
CVE-2025-32255 | Medium | 5.3 | 2025-04-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ERA404 StaffList stafflist allows Retrieve Embedded Sensitive Data… |
CVE-2025-32254 | Medium | 5.3 | 2025-04-04 | Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBoo… |
CVE-2025-32253 | Medium | 5.3 | 2025-04-04 | Missing Authorization vulnerability in ComMotion Course Booking System course-booking-system allows Accessing Functionality Not Properly Constrained by ACLs.Th… |
CVE-2025-32252 | Medium | 5.3 | 2025-04-04 | Missing Authorization vulnerability in Black and White WP Genealogy – Your Family History Website wpgenealogy allows Exploiting Incorrectly Configured Access C… |
CVE-2025-32251 | Medium | 5.3 | 2025-04-04 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in J. Tyler Wiest Jetpack Feedback Exporter jetpack-feedback-exporter… |
CVE-2025-32250 | Medium | 5.4 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in rollbar Rollbar rollbar allows Cross Site Request Forgery.This issue affects Rollbar: from n/a through <= 2… |
CVE-2025-32249 | Medium | 5.4 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in Designinvento DirectoryPress directorypress allows Cross Site Request Forgery.This issue affects DirectoryPr… |
CVE-2025-32248 | Medium | 5.4 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in SwiftXR SwiftXR (3D/AR/VR) Viewer swiftxr-3darvr-viewer allows Cross Site Request Forgery.This issue affects… |
CVE-2025-32247 | Medium | 5.4 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in ABCdatos AI Content Creator ai-content-creator allows Cross Site Request Forgery.This issue affects AI Conte… |
CVE-2025-32246 | Medium | 5.4 | 2025-04-04 | Missing Authorization vulnerability in Tim Nguyen 1-Click Backup & Restore Database 1-click-backup-restore-database-by-sunbytes allows Exploiting Incorrectly C… |
CVE-2025-32241 | Medium | 6.5 | 2025-04-04 | Cross-Site Request Forgery (CSRF) vulnerability in CleverReach® Official CleverReach Plugin for WooCommerce cleverreach-wc allows Cross Site Request Forgery.Th… |
CVE-2025-32239 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Joao Romao Social Share Buttons & Analytics Plugin – GetSocial.io wp-share-buttons-analytics-by-getsocial allows Exploit… |
CVE-2025-32238 | Medium | 4.3 | 2025-04-04 | Generation of Error Message Containing Sensitive Information vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-schedul… |
CVE-2025-32237 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-32235 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar mp3-music-player-by-sonaar allows Exploiting Incorrectly Co… |
CVE-2025-32234 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in aleswebs AdMail – Multilingual Back in-Stock Notifier for WooCommerce admail allows Exploiting Incorrectly Configured Ac… |
CVE-2025-32233 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in WP Chill Revive.so revive-so allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-32232 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in ERA404 StaffList stafflist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects St… |
CVE-2025-32231 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Bookingor Bookingor bookingor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-32229 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Bowo Variable Inspector variable-inspector allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-32226 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Anzar Ahmed Display product variations dropdown on shop page display-product-variations-dropdown-on-shop-page allows Exp… |
CVE-2025-32225 | Medium | 5.3 | 2025-04-04 | Missing Authorization vulnerability in WP Event Manager WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-32224 | Medium | 5.4 | 2025-04-04 | Missing Authorization vulnerability in Shivam Mani Tripathi Privyr CRM Integration privy-crm-integration allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-32220 | Medium | 5.4 | 2025-04-04 | Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-32219 | Medium | 5.4 | 2025-04-04 | Missing Authorization vulnerability in Syntactics, Inc. eaSYNC easync-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-32218 | Medium | 5.4 | 2025-04-04 | Missing Authorization vulnerability in RealMag777 TableOn posts-table-filterable allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-32217 | Medium | 5.4 | 2025-04-04 | Missing Authorization vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-generator-for-wp allows Exploiting Incorrectly Configure… |
CVE-2025-32207 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anzar Ahmed Ni WooCommerce Cost Of Goods ni-woocommerce-c… |
CVE-2025-32204 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rocketelements Split Test For Elementor split-test-for-el… |
CVE-2025-32203 | High | 7.6 | 2025-04-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in manu225 Falling things falling-things allows SQL Injectio… |
CVE-2025-32201 | Medium | 4.3 | 2025-04-04 | Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-32197 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons… |
CVE-2025-32196 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-… |
CVE-2025-32195 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecwid by Lightspeed Ecommerce Shopping Cart Ecwid Shoppin… |
CVE-2025-32194 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-el… |
CVE-2025-32193 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMinds Simple WP Events simple-wp-events allows Stored X… |
CVE-2025-32192 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UltraPress Ultra Addons Lite for Elementor ut-elementor-a… |
CVE-2025-32191 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webangon News Element Elementor Blog Magazine news-elemen… |
CVE-2025-32190 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartwpress Musician's Pack For Elementor music-pack-for-… |
CVE-2025-32189 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Best WP Developer BWD Elementor Addons bwd-elementor-addo… |
CVE-2025-32188 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels advanced-woo-labels allows Stor… |
CVE-2025-32187 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Quý Lê 91 Administrator Z administrator-z allows DOM-Base… |
CVE-2025-32186 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Turbo Addons Turbo Addons Elementor turbo-addons-elemento… |
CVE-2025-32185 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder a… |
CVE-2025-32184 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-sto… |
CVE-2025-32183 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Galaxy Weblinks Video Playlist For YouTube video-playlist… |
CVE-2025-32182 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spider Themes Spider Elements spider-elements allows Stor… |
CVE-2025-32181 | Medium | 6.5 | 2025-04-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fast Simon Search, Filters & Merchandising for WooCommerc… |