2025 CVEs (page 379)
Page 379 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2820 | Medium | 6.5 | 2025-03-26 | An authenticated attacker can compromise the availability of the device via the network |
CVE-2025-2819 | Medium | 6.6 | 2025-03-26 | There is a risk of unauthorized file uploads in GT-SoftControl and potential file overwrites due to insufficient validation in the file selection process. This… |
CVE-2025-28942 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Trust Payments Trust Payments Gateway for WooCommerce tru… |
CVE-2025-28939 | High | 8.5 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EuroCizia WP Google Calendar Manager wp-gcalendar allows… |
CVE-2025-28935 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Fancybox Plus fancybox-plus allows Reflected XSS.T… |
CVE-2025-28934 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chaozh Simple Post Series simple-post-series allows Refle… |
CVE-2025-28928 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sureshdsk Are you robot google recaptcha for wordpress ar… |
CVE-2025-28924 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simbul ZenphotoPress zenphotopress allows Reflected XSS.T… |
CVE-2025-28921 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in homejunction SpatialMatch IDX spatialmatch-free-lifestyle… |
CVE-2025-28917 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crazyloong Custom Smilies custom-smilies-se allows Stored… |
CVE-2025-28916 | Critical | 9.8 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local… |
CVE-2025-28911 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gravity2pdf Gravity 2 PDF gf2pdf allows Reflected XSS.Thi… |
CVE-2025-28903 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hectorgarrofe Driving Directions ddirections allows Refle… |
CVE-2025-28899 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in toddhuish WP Event Ticketing wpeventticketing allows Refl… |
CVE-2025-28898 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator… |
CVE-2025-28893 | Critical | 9.9 | 2025-03-26 | Improper Control of Generation of Code ('Code Injection') vulnerability in Govind Visual Text Editor visual-text-editor allows Remote Code Inclusion.This issue… |
CVE-2025-28890 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in puzich Lightview Plus lightview-plus allows Reflected XSS… |
CVE-2025-28889 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in starblank Custom Product Stickers for Woocommerce custom-… |
CVE-2025-28885 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fiverraffiliates Fiverr.com Official Search Box fiverr-of… |
CVE-2025-28882 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Omnify, Inc. Omnify omnify-widget allows Reflected XSS.Th… |
CVE-2025-28880 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jotis Blue Captcha blue-captcha allows Reflected XSS.This… |
CVE-2025-28877 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in m.tiggelaar Key4ce osTicket Bridge key4ce-osticket-bridge… |
CVE-2025-28873 | High | 8.5 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Scott Taylor Shuffle shuffle allows Blind SQL Injection.T… |
CVE-2025-28869 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shauno NextGEN Gallery Voting nextgen-gallery-voting allo… |
CVE-2025-28865 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lionelroux WP Colorful Tag Cloud wp-colorful-tag-cloud al… |
CVE-2025-28858 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Maps ap-google-maps allows Reflected… |
CVE-2025-28855 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Teleport teleport allows Reflected XSS.This issue… |
CVE-2025-27404 | High | 7.6 | 2025-03-26 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. A vulnerability in versions prior to 2.11.5 and 2.12.13 allows a… |
CVE-2025-27267 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in srcoley Random Quotes random-quotes allows Reflected XSS… |
CVE-2025-27015 | High | 7.5 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in designingmedia Hostiko hostiko allows… |
CVE-2025-27014 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designingmedia Hostiko hostiko allows Reflected XSS.This… |
CVE-2025-26986 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Pearl - Corporate Busin… |
CVE-2025-26941 | Critical | 9.3 | 2025-03-26 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin allows SQL Injection… |
CVE-2025-26929 | Medium | 5.9 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Accounting for WooCommerce accounting-for-wooc… |
CVE-2025-26923 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This i… |
CVE-2025-26922 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in techthemes AuraMart auramart allows Stored XSS.This issue… |
CVE-2025-26869 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Build allows Stored XSS.This issue affects Build: from n/… |
CVE-2025-26747 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 99colorthemes RainbowNews allows Stored XSS.This issue af… |
CVE-2025-26739 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefunction newseqo allows Stored XSS.This issue affect… |
CVE-2025-26584 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Travis Ballard TBTestimonials tb-testimonials allows Refl… |
CVE-2025-26583 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Video Share VOD video-share-vod allows Refle… |
CVE-2025-26581 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper Picture Gallery picture-gallery allows Refle… |
CVE-2025-26579 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in videowhisper MicroPayments paid-membership allows Reflect… |
CVE-2025-26576 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in takumin WP Simple Slideshow wp-simple-slideshow allows Re… |
CVE-2025-26575 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Maurer Display Post Meta display-post-meta allows Re… |
CVE-2025-26573 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JamRizzi Technologies Rizzi Guestbook rizzi-guestbook all… |
CVE-2025-26566 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frank In Stock Mailer for WooCommerce in-stock-mailer-for… |
CVE-2025-26565 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUPress gnupress allows Reflected XSS.This issue a… |
CVE-2025-26564 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kagla GNUCommerce gnucommerce allows Reflected XSS.This i… |
CVE-2025-26560 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KKWangen WP Contact Form III wp-contact-form-iii allows R… |
CVE-2025-26559 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Taylor Secure Invites wordpress-mu-secure-invites a… |
CVE-2025-26546 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelpro Cookies Pro cookies-pro allows Reflected XSS.Thi… |
CVE-2025-26544 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max K UTM tags tracking for Contact Form 7 cf7-utm-tracki… |
CVE-2025-26542 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dang Ngoc Binh Zalo Live Chat zalo-live-chat allows Refle… |
CVE-2025-26541 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeSolz Bitcoin / AltCoin Payment Gateway for WooCommerc… |
CVE-2025-26537 | Medium | 6.5 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rolomak GDPR Tools gdpr-tools allows Stored XSS.This issu… |
CVE-2025-26536 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yendif Player Another Events Calendar another-events-cale… |
CVE-2025-25134 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zenverse Theme Demo Bar wordpress-theme-demo-bar allows R… |
CVE-2025-24972 | Medium | 4.3 | 2025-03-26 | Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, in specific circumsta… |
CVE-2025-24690 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality all… |
CVE-2025-23964 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ajitae Google Plus google-plus-google allows Reflected XS… |
CVE-2025-23952 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ntm custom-field-list-widget custom-fi… |
CVE-2025-23937 | High | 8.1 | 2025-03-26 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Furr LinkedIn Lite linkedin-lite… |
CVE-2025-23735 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cosmin Schiopu Infugrator infugrator allows Reflected XSS… |
CVE-2025-23728 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in atelierhyper AuMenu aumenu allows Reflected XSS.This issu… |
CVE-2025-23714 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in podspod AppReview appreview allows Reflected XSS.This iss… |
CVE-2025-23704 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Reuven Karasik Your Lightbox your-lightbox allows Reflect… |
CVE-2025-23680 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Narnoo Narnoo Operator narnoo-shortcodes allows Reflected… |
CVE-2025-23666 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cxc-sawa Management-screen-droptiles cxc-sawa allows Refl… |
CVE-2025-23638 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Umesh Ghimire Frontend Post Submission frontend-post-subm… |
CVE-2025-23633 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khanhtruong WP Database Audit database-audit allows Refle… |
CVE-2025-23632 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhizome Networks CG Button content-glass-button allows Re… |
CVE-2025-23612 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixobe Pixobe Cartography pixobe-cartography allows Refle… |
CVE-2025-23546 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP inGroups+ rdp-ingroups allows Reflecte… |
CVE-2025-23543 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fomopay FOMO Pay Chinese Payment Solution fomo-payment-ga… |
CVE-2025-23542 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert D Payne RDP Linkedin Login rdp-linkedin-login allo… |
CVE-2025-23466 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsiteeditor Site Editor Google Map site-editor-google-ma… |
CVE-2025-23460 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhizomaticweb RWS Enquiry And Lead Follow-up rws-enquiry… |
CVE-2025-23459 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NsThemes NS Simple Intro Loader ns-simple-intro-loader al… |
CVE-2025-22283 | High | 7.1 | 2025-03-26 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Riyaz GetSocial getsocial allows Reflected XSS.This issue… |
CVE-2025-24808 | Medium | 4.3 | 2025-03-26 | Discourse is an open-source discussion platform. Prior to versions `3.3.4` on the `stable` branch and `3.4.0.beta5` on the `beta` branch, someone who is about… |
CVE-2025-23203 | Medium | 5.5 | 2025-03-26 | Icinga Director is an Icinga config deployment tool. A Security vulnerability has been found starting in version 1.0.0 and prior to 1.10.4 and 1.11.4 on severa… |
CVE-2025-2228 | Medium | 5.7 | 2025-03-26 | The Responsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates plugin for WordPress is vulnerable to Sensitive Information Exposure… |
CVE-2025-2110 | High | 8.8 | 2025-03-26 | The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to mis… |
CVE-2025-1913 | High | 7.2 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, a… |
CVE-2025-1912 | High | 7.6 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions u… |
CVE-2025-1911 | Low | 2.7 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f… |
CVE-2025-1769 | Medium | 4.9 | 2025-03-26 | The Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress is vulnerable to Directory Traversal in all versions up to, an… |
CVE-2025-1312 | Medium | 6.4 | 2025-03-26 | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttonTextColor’ parameter in all vers… |
CVE-2025-2596 | Medium | 5.3 | 2025-03-26 | Session logout could be overwritten in Checkmk GmbH's Checkmk versions <2.3.0p30, <2.2.0p41, and 2.1.0p49 (EOL) |
CVE-2025-27552 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with progr… |
CVE-2025-27551 | Medium | 4.0 | 2025-03-26 | DBIx::Class::EncodedColumn use the rand() function, which is not cryptographically secure to salt password hashes. This vulnerability is associated with progr… |
CVE-2025-1542 | | 2025-03-26 | Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain… | |
CVE-2025-1703 | Medium | 6.4 | 2025-03-26 | The Ultimate Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 3.2.7 d… |
CVE-2025-1440 | Medium | 5.3 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to unauthorized excessive creation of options on the aip_map_url_callback() function in all versions up… |
CVE-2025-1439 | Medium | 6.4 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2025-1437 | Medium | 6.4 | 2025-03-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2025-1310 | Medium | 6.5 | 2025-03-26 | The Jobs for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.11 via the 'job_postings_get_file' p… |
CVE-2025-2257 | High | 7.2 | 2025-03-26 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to… |
CVE-2025-2167 | Medium | 5.4 | 2025-03-26 | The Event post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list' shortcodes in all versions up to, and including… |