2025 CVEs (page 376)
Page 376 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-30865 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in fuzzoid 3DPrint Lite 3dprint-lite allows Cross Site Request Forgery.This issue affects 3DPrint Lite: from n/… |
CVE-2025-30864 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in falselight Exchange Rates exchange-rates allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-30863 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-… |
CVE-2025-30862 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA… |
CVE-2025-30861 | Medium | 4.9 | 2025-03-27 | Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-30860 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off… |
CVE-2025-30859 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a… |
CVE-2025-30857 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in PressMaximum Currency Switcher for WooCommerce currency-switcher-for-woocommerce allows Stored XSS.This issu… |
CVE-2025-30856 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Cross Site Request Forger… |
CVE-2025-30854 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator… |
CVE-2025-30851 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-30850 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue af… |
CVE-2025-30847 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue aff… |
CVE-2025-30846 | High | 8.8 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPre… |
CVE-2025-30845 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in webangon The Pack Elementor addons the… |
CVE-2025-30843 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in setriosoft bizcalendar-web bizcalendar-web allows SQL Inj… |
CVE-2025-30842 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in pixolette Christmas Panda christmas-panda allows Cross Site Request Forgery.This issue affects Christmas Pan… |
CVE-2025-30839 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured A… |
CVE-2025-30838 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This… |
CVE-2025-30836 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint latepoint allows Stored XSS.This issu… |
CVE-2025-30833 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through… |
CVE-2025-30832 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows DO… |
CVE-2025-30831 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themifyme Themify Event Post themify-e… |
CVE-2025-30830 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-30829 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Lo… |
CVE-2025-30828 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects T… |
CVE-2025-30826 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy IP Locator ip-locator allows DOM-Based XSS… |
CVE-2025-30824 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-30823 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from… |
CVE-2025-30822 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Hakik Zaman Custom Login Logo ideal-wp-login-logo-changer allows Cross Site Request Forgery.This issue affec… |
CVE-2025-30821 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in otacke SNORDIAN's H5PxAPIkatchu h5pxapikatchu allows Accessing Functionality Not Properly Constrained by ACLs.This issue… |
CVE-2025-30820 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins WishSuite wishsuite allows… |
CVE-2025-30819 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Igor Benic Simple Giveaways giveasap allows SQL Injection… |
CVE-2025-30818 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows DOM-Based XSS.Th… |
CVE-2025-30817 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in wpzita Z Companion z-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-30816 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This i… |
CVE-2025-30815 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affec… |
CVE-2025-30814 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme The Post Grid the-post-gri… |
CVE-2025-30813 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester listamester allows Stored XSS.Thi… |
CVE-2025-30812 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor skt-addons-for-elem… |
CVE-2025-30811 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue a… |
CVE-2025-30810 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-lea… |
CVE-2025-30809 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-30806 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-p… |
CVE-2025-30805 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cooki… |
CVE-2025-30804 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei allows Cross Site Request Forger… |
CVE-2025-30803 | Medium | 4.3 | 2025-03-27 | Missing Authorization vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-30801 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews twb-woocommerce-reviews allows Cross Site Request Forgery.This issue affec… |
CVE-2025-30800 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atawai Gum Elementor Addon gum-elementor-addon allows Sto… |
CVE-2025-30799 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup WP Google Street View wp-google-street-view allows… |
CVE-2025-30795 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects Fun… |
CVE-2025-30792 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ufukart Comment Approved Notifier Extended comment-approv… |
CVE-2025-30791 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdever Cart tracking for WooCommerce cart-tracking-for-w… |
CVE-2025-30790 | Medium | 5.3 | 2025-03-27 | Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Accessing Functionality Not Properly Constrained by ACLs.This issue af… |
CVE-2025-30789 | Medium | 5.9 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in clearoutio Clearout Email Validator clearout-email-valida… |
CVE-2025-30788 | High | 8.2 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows SQL Injection.This issue affects EZ S… |
CVE-2025-30787 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL… |
CVE-2025-30786 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.T… |
CVE-2025-30785 | High | 7.5 | 2025-03-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite… |
CVE-2025-30784 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms al… |
CVE-2025-30783 | High | 8.2 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP… |
CVE-2025-30781 | Medium | 4.7 | 2025-03-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules… |
CVE-2025-30780 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This… |
CVE-2025-30779 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie all… |
CVE-2025-30777 | Medium | 4.3 | 2025-03-27 | Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-30776 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue af… |
CVE-2025-30775 | High | 8.5 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows SQ… |
CVE-2025-30773 | High | 7.2 | 2025-03-27 | Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePr… |
CVE-2025-30772 | High | 8.8 | 2025-03-27 | Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects… |
CVE-2025-30771 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify wp-cassify allows DOM-… |
CVE-2025-30770 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.Th… |
CVE-2025-30769 | High | 7.1 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in alexvtn WIP WooCarousel Lite wip-woocarousel-lite allows Stored XSS.This issue affects WIP WooCarousel Lite… |
CVE-2025-30768 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows Stored XSS.This… |
CVE-2025-30767 | Medium | 5.4 | 2025-03-27 | Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-30766 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-a… |
CVE-2025-30765 | High | 7.6 | 2025-03-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPPOOL FlexStock stock-sync-with-google-sheet-for-woocomm… |
CVE-2025-30764 | Medium | 4.3 | 2025-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in AntoineH Football Pool football-pool allows Cross Site Request Forgery.This issue affects Football Pool: fro… |
CVE-2025-30763 | Medium | 6.5 | 2025-03-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows… |
CVE-2025-29993 | Medium | 5.3 | 2025-03-27 | The affected versions of PowerCMS allow HTTP header injection. This vulnerability can be leveraged to direct the affected product to send email with a tampered… |
CVE-2025-2685 | Medium | 6.4 | 2025-03-27 | The TablePress – Tables in WordPress made easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘table-name’ parameter in all versions… |
CVE-2025-2332 | Critical | 9.8 | 2025-03-27 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.13 v… |
CVE-2025-0273 | Medium | 5.5 | 2025-03-27 | HCL DevOps Deploy / HCL Launch stores potentially sensitive authentication token information in log files that could be read by a local user. |
CVE-2025-31165 | | 2025-03-27 | Cross-Site Scripting (XSS) vulnerability in the Logbug module of NightWolf Penetration Testing Platform 1.2.2 allows attackers to execute JavaScript through th… | |
CVE-2025-2835 | Medium | 4.3 | 2025-03-27 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been declared as problematic. Affected by this vulnerability is the function autoLink of the… |
CVE-2025-2833 | Medium | 5.3 | 2025-03-27 | A vulnerability was found in zhangyd-c OneBlog up to 2.3.9. It has been classified as problematic. Affected is an unknown function of the component HTTP Header… |
CVE-2025-2832 | Medium | 4.3 | 2025-03-27 | A vulnerability was found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as problematic. This issue… |
CVE-2025-2831 | Medium | 6.3 | 2025-03-27 | A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vul… |
CVE-2025-2481 | Medium | 6.1 | 2025-03-27 | The MediaView plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id' parameter in all versions up to, and including, 1.1.2 due to in… |
CVE-2025-30355 | High | 7.1 | 2025-03-27 | Synapse is an open source Matrix homeserver implementation. A malicious server can craft events which, when received, prevent Synapse version up to 1.127.0 fro… |
CVE-2025-20230 | Medium | 4.3 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platf… |
CVE-2025-30407 | Medium | 6.3 | 2025-03-26 | Local privilege escalation due to a binary hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before bui… |
CVE-2025-2838 | Medium | 6.5 | 2025-03-26 | Silicon Labs Gecko OS DNS Response Processing Infinite Loop Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to create a d… |
CVE-2025-2837 | High | 8.8 | 2025-03-26 | Silicon Labs Gecko OS HTTP Request Handling Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attacke… |
CVE-2025-20233 | Low | 2.5 | 2025-03-26 | In the Splunk App for Lookup File Editing versions below 4.0.5, a script in the app used the `chmod` and `makedirs` Python functions in a way that resulted in… |
CVE-2025-20232 | Medium | 5.7 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and… |
CVE-2025-20231 | High | 7.1 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and versions below 3.8.38 and 3.7.23 of the Splunk Secure Gateway app on Splunk Cloud Platf… |
CVE-2025-20229 | High | 8.0 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.104, 9.2.2406.108, 9.2.2403.114, and 9.1.2312.2… |
CVE-2025-20228 | Medium | 6.5 | 2025-03-26 | In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.2.2403.108, and 9.1.2312.204, a low-privileged user that… |
CVE-2025-20227 | Medium | 4.3 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8, and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.112, 9.2.2403.115, 9.1.2312… |
CVE-2025-20226 | Medium | 5.7 | 2025-03-26 | In Splunk Enterprise versions below 9.4.1, 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.107, 9.2.2406.111, and 9.1.2308.214, a low… |