2025 CVEs (page 369)
Page 369 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31805 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Gutena Kit – Gutenberg Blocks and Templates gu… |
CVE-2025-31804 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DraftPress Team Follow Us Badges wpsite-follow-us-badges… |
CVE-2025-31803 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Neteuro Turisbook Booking System turisbook-booking-system… |
CVE-2025-31802 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in Shiptimize Shiptimize for WooCommerce shiptimize-for-woocommerce allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-31801 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks mx-time-zone-clocks allo… |
CVE-2025-31799 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pu… |
CVE-2025-31798 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in publitio Publitio publitio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pu… |
CVE-2025-31797 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Stored XSS… |
CVE-2025-31796 | Medium | 5.4 | 2025-04-01 | Server-Side Request Forgery (SSRF) vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elementor allows Server Side Request Forgery.This issue… |
CVE-2025-31793 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XS… |
CVE-2025-31792 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Forms piotnetforms allows Stored XS… |
CVE-2025-31791 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in Oliver Boyers Pin Generator pin-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-31790 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Binsaifullah Posten posten-post-blocks allows DOM-Based X… |
CVE-2025-31788 | Medium | 5.3 | 2025-04-01 | Insertion of Sensitive Information into Log File vulnerability in Smackcoders Inc., AIO Performance Profiler, Monitor, Optimize, Compress & Debug all-in-one-pe… |
CVE-2025-31787 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in AudioTheme Cue cue allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cue: from… |
CVE-2025-31786 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in Travis Simple Icons simple-icons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-31785 | Medium | 5.4 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Clearbit Clearbit Reveal clearbit allows Cross Site Request Forgery.This issue affects Clearbit Reveal: from… |
CVE-2025-31784 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Rudy Susanto Embed Extended embed-extended allows Cross Site Request Forgery.This issue affects Embed Extend… |
CVE-2025-31783 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Leartes.NET Leartes TRY Exchange Rates leartes-try-exchan… |
CVE-2025-31782 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in pupunzi mb.YTPlayer wpmbytplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-31781 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in ahmadshyk Gift Cards for WooCommerce woo-giftcards allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-31780 | Medium | 6.5 | 2025-04-01 | Missing Authorization vulnerability in Andy Stratton Append Content append-content allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-31779 | Medium | 5.4 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Jonathan Daggerhart Query Wrangler query-wrangler allows Cross Site Request Forgery.This issue affects Query… |
CVE-2025-31778 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in raphaelheide Donate Me donate-me allows Reflected XSS.Thi… |
CVE-2025-31777 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in BeastThemes Clockinator Lite clockify-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-31776 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Aphotrax Uptime Robot Plugin for WordPress uptime-robot-monitor allows Cross Site Request Forgery.This issue… |
CVE-2025-31775 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Smackcoders Inc., Google SEO Pressor Snippet google-seo-author-snippets allows Cross Site Request Forgery.Th… |
CVE-2025-31774 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in WebProtect.ai Astra Security Suite getastra allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-31773 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in cedcommerce Ship Per Product ship-per-product allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2025-31772 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify WP Modal Popup with Cookie Integration wp-moda… |
CVE-2025-31771 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sultan Nasir Uddin Team Members for Elementor Page Builde… |
CVE-2025-31770 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light all… |
CVE-2025-31769 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in NiteoThemes CLP – Custom Login Page by NiteoThemes clp-custom-login-page allows Cross Site Request Forgery.T… |
CVE-2025-31767 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templat… |
CVE-2025-31766 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PhotoShelter PhotoShelter for Photographers Blog Feed Plu… |
CVE-2025-31765 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in themeqx GDPR Cookie Notice gdpr-cookie-notice allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-31764 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Preliot Cache control by Cacholong cache-control-by-cacho… |
CVE-2025-31763 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Preliot Cache control by Cacholong cache-control-by-cacholong allows Cross Site Request Forgery.This issue a… |
CVE-2025-31762 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyazimov Sheet2Site sheet2site allows Stored XSS.This… |
CVE-2025-31761 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DEJAN Hypotext hypotext allows Stored XSS.This issue affe… |
CVE-2025-31760 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snapwidget SnapWidget Social Photo Feed Widget snapwidget… |
CVE-2025-31759 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BooSpot Boo Recipes boo-recipes allows Stored XSS.This is… |
CVE-2025-31757 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in BinaryCarpenter Free Woocommerce Product Table View free-product-table-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-31756 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in tuyennv TZ PlusGallery tz-plus-gallery allows Cross Site Request Forgery.This issue affects TZ PlusGallery… |
CVE-2025-31755 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in josselynj pCloud Backup pcloud-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-31754 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DobsonDev DobsonDev Shortcodes dobsondev-shortcodes allow… |
CVE-2025-31752 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in termel Bulk Fields Editor bulk-user-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-31751 | Medium | 6.5 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in doit Breaking News WP breaking-news-wp allows Cross Site Request Forgery.This issue affects Breaking News WP… |
CVE-2025-31750 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in doit Breaking News WP breaking-news-wp allows Stored XSS… |
CVE-2025-31749 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPelite HMH Footer Builder For Elementor hmh-footer-build… |
CVE-2025-31748 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Portfolio opal-portfolios allows Stored XSS.T… |
CVE-2025-31747 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in milan.latinovic WP Chrono wp-chrono allows DOM-Based XSS… |
CVE-2025-31745 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arni Cinco Subscription Form for Feedblitz feedblitz-emai… |
CVE-2025-31744 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpszaki Lightweight and Responsive Youtube Embed lightwei… |
CVE-2025-31743 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpszaki Lightweight and Responsive Youtube Embed lightwei… |
CVE-2025-31742 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PixelDima Dima Take Action dima-take-action allows Stored… |
CVE-2025-31741 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filtr8 Easy Magazine filtr8-magazine allows DOM-Based XSS… |
CVE-2025-31740 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aThemeArt News, Magazine and Blog Elements news-magazine-… |
CVE-2025-31738 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yazamodeveloper LeadQuizzes leadquizzes allows Stored XSS… |
CVE-2025-31737 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dxladner Client Showcase client-showcase allows Stored XS… |
CVE-2025-31735 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in C. Johnson Footnotes for WordPress footnotes-for-wordpres… |
CVE-2025-31734 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Simple Post Expiration simple-post-expiration… |
CVE-2025-31733 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap wpsitemap allows Stored XSS.This issu… |
CVE-2025-31732 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in gb-plugins GB Gallery Slideshow gb-gallery-slideshow allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-31731 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Philip John Author Bio Shortcode author-bio-shortcode all… |
CVE-2025-31730 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DigitalCourt Marketer Addons marketer-addons allows Store… |
CVE-2025-31132 | High | 8.1 | 2025-04-01 | Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1… |
CVE-2025-31131 | High | 8.6 | 2025-04-01 | YesWiki is a wiki system written in PHP. The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server… |
CVE-2025-31121 | Medium | 5.4 | 2025-04-01 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 7.0.3.1, the Patient Image feature in OpenEMR… |
CVE-2025-30676 | Medium | 6.1 | 2025-04-01 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.19… |
CVE-2025-30354 | Medium | 4.3 | 2025-04-01 | Bruno is an open source IDE for exploring and testing APIs. A bug in the assertion runtime caused assert expressions to run in Developer Mode, even if Safe Mod… |
CVE-2025-30224 | | 2025-04-01 | MyDumper is a MySQL Logical Backup Tool. The MySQL C client library (libmysqlclient) allows authenticated remote actors to read arbitrary files from client sys… | |
CVE-2025-30210 | Medium | 6.1 | 2025-04-01 | Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltip were setting the… |
CVE-2025-28398 | High | 7.1 | 2025-04-01 | D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_net_asp function via the remot_ip parameter. |
CVE-2025-28395 | High | 7.1 | 2025-04-01 | D-LINK DI-8100 16.07.26A1 is vulnerable to Buffer Overflow in the ipsec_road_asp function via the host_ip parameter. |
CVE-2025-3035 | Medium | 5.3 | 2025-04-01 | By first using the AI chatbot in one tab and later activating it in another tab, the document title of the previous tab would leak into the chat prompt. This v… |
CVE-2025-3034 | High | 8.1 | 2025-04-01 | Memory safety bugs present in Firefox 136 and Thunderbird 136. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-3033 | High | 7.7 | 2025-04-01 | After selecting a malicious Windows `.url` shortcut from the local filesystem, an unexpected file could be uploaded. *This bug only affects Firefox on Window… |
CVE-2025-3032 | High | 7.4 | 2025-04-01 | Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox… |
CVE-2025-3031 | Medium | 6.5 | 2025-04-01 | An attacker could read 32 bits of values spilled onto the stack in a JIT compiled function. This vulnerability was fixed in Firefox 137 and Thunderbird 137. |
CVE-2025-3030 | High | 8.1 | 2025-04-01 | Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-3029 | High | 7.3 | 2025-04-01 | A crafted URL containing specific Unicode characters could have hidden the true origin of the page, resulting in a potential spoofing attack. This vulnerabilit… |
CVE-2025-3028 | Medium | 6.5 | 2025-04-01 | JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firef… |
CVE-2025-31408 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in Zoho Flow Zoho Flow zoho-flow allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-22231 | High | 7.8 | 2025-04-01 | VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with local administrative privileges can escalate their privilege… |
CVE-2025-1660 | High | 7.8 | 2025-04-01 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force a Memory Corruption vulnerability. A malicious actor can leverage this vuln… |
CVE-2025-1659 | High | 7.8 | 2025-04-01 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vu… |
CVE-2025-1658 | High | 7.8 | 2025-04-01 | A maliciously crafted DWFX file, when parsed through Autodesk Navisworks, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vu… |
CVE-2025-3085 | High | 8.1 | 2025-04-01 | A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails to check the revocation status of the in… |
CVE-2025-3084 | Medium | 6.5 | 2025-04-01 | When run on commands with certain arguments set, explain may fail to validate these arguments before using them. This can lead to crashes in router servers. Th… |
CVE-2025-3083 | High | 7.5 | 2025-04-01 | Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connecti… |
CVE-2025-30177 | Medium | 6.5 | 2025-04-01 | Bypass/Injection vulnerability in Apache Camel in Camel-Undertow component under particular conditions. This issue affects Apache Camel: from 4.10.0 before 4… |
CVE-2025-2906 | Medium | 6.4 | 2025-04-01 | The Contempo Real Estate Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.6.3 due to i… |
CVE-2025-2237 | Critical | 9.8 | 2025-04-01 | The WP RealEstate plugin for WordPress, used by the Homeo theme, is vulnerable to privilege escalation in all versions up to, and including, 1.6.26. This is du… |
CVE-2025-3082 | Low | 3.1 | 2025-04-01 | A user authorized to access a view may be able to alter the intended collation, allowing them to access to a different or unintended view of underlying data. T… |
CVE-2025-27130 | High | 8.8 | 2025-04-01 | Welcart e-Commerce 2.11.6 and earlier versions contains an untrusted data deserialization vulnerability. If this vulnerability is exploited, arbitrary code may… |
CVE-2025-30065 | Critical | 9.8 | 2025-04-01 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code Users are recommended to… |
CVE-2025-2891 | High | 8.8 | 2025-04-01 | The Real Estate 7 WordPress theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the 'template-submit-listing.ph… |
CVE-2025-29868 | Medium | 6.5 | 2025-04-01 | Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an exter… |
CVE-2025-27427 | Medium | 4.3 | 2025-04-01 | A vulnerability exists in Apache ActiveMQ Artemis whereby a user with the createDurableQueue or createNonDurableQueue permission on an address can augment the… |