2025 CVEs (page 425)
Page 425 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0369 | Medium | 6.4 | 2025-01-18 | The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to… |
CVE-2025-0554 | Medium | 4.4 | 2025-01-18 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficien… |
CVE-2025-0318 | Medium | 5.3 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Inform… |
CVE-2025-0308 | High | 7.5 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-b… |
CVE-2025-23209 | High | 8.0 | 2025-01-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that… |
CVE-2025-23208 | High | 7.3 | 2025-01-17 | zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revoca… |
CVE-2025-23207 | Medium | 6.3 | 2025-01-17 | KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToStri… |
CVE-2025-0541 | Medium | 6.3 | 2025-01-17 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/a… |
CVE-2025-23206 | High | 8.1 | 2025-01-17 | The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS Cl… |
CVE-2025-23205 | | 2025-01-17 | nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content… | |
CVE-2025-23202 | | 2025-01-17 | Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the B… | |
CVE-2025-23039 | Medium | 5.2 | 2025-01-17 | Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL de… |
CVE-2025-21606 | | 2025-01-17 | stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of… | |
CVE-2025-0540 | Medium | 6.3 | 2025-01-17 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-0538 | Low | 3.5 | 2025-01-17 | A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-21399 | High | 7.4 | 2025-01-17 | Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability |
CVE-2025-21185 | Medium | 6.5 | 2025-01-17 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2025-0537 | Low | 2.4 | 2025-01-17 | A vulnerability, which was classified as problematic, has been found in code-projects Car Rental Management System 1.0. This issue affects some unknown process… |
CVE-2025-0536 | Medium | 6.3 | 2025-01-17 | A vulnerability classified as critical was found in 1000 Projects Attendance Tracking Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2025-0535 | Medium | 6.3 | 2025-01-17 | A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem… |
CVE-2025-0534 | High | 7.3 | 2025-01-17 | A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been rated as critical. Affected by this issue is some unk… |
CVE-2025-0533 | High | 7.3 | 2025-01-17 | A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been declared as critical. Affected by this vulnerability… |
CVE-2025-0532 | Medium | 6.3 | 2025-01-17 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/adm… |
CVE-2025-0430 | High | 7.5 | 2025-01-17 | Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to create a denial-of-servi… |
CVE-2025-0531 | Medium | 6.3 | 2025-01-17 | A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/leaveroom.p… |
CVE-2025-0530 | Low | 3.5 | 2025-01-17 | A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/… |
CVE-2025-0529 | Medium | 5.3 | 2025-01-17 | A vulnerability, which was classified as critical, was found in code-projects Train Ticket Reservation System 1.0. This affects an unknown part of the componen… |
CVE-2025-0528 | High | 7.2 | 2025-01-17 | A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality… |
CVE-2025-0527 | High | 7.3 | 2025-01-17 | A vulnerability classified as critical was found in code-projects Admission Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-21325 | High | 7.8 | 2025-01-17 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |
CVE-2025-23201 | Medium | 5.4 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to Cross-site Scripting (XSS) on the parameters:`/addhost`… |
CVE-2025-23200 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `ajax_form.php` -> param… |
CVE-2025-23199 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameter: `/ajax_form.php` -> param… |
CVE-2025-23198 | Medium | 4.6 | 2025-01-16 | librenms is a community-based GPL-licensed network monitoring system. Affected versions are subject to a stored XSS on the parameters (Replace $DEVICE_ID with… |
CVE-2025-23965 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kopatheme Kopa Nictitate Toolkit kopa-nictitate-toolkit a… |
CVE-2025-23963 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in flymke Mark Posts mark-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-23962 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in jjtrabucco Goldstar goldstar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-23961 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in wptasker WordPress Graphs & Charts graph-lite allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-23957 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in surdotly Sur.ly surly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sur.ly… |
CVE-2025-23955 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in xola Xola xola-bookings-for-tours-activities allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-23954 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in awcode Salvador – AI Image Generator salvador-ai-image-generator allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-23951 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DIVENGINE Gallery: Hybrid – Advanced Visual Gallery hybri… |
CVE-2025-23950 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ezmarketing EZPlayer ezplayer allows Stored XSS.This issu… |
CVE-2025-23947 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M.J WP-Player wp-player allows Stored XSS.This issue affe… |
CVE-2025-23946 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Le-Pixel-Solitaire Enhanced YouTube Shortcode enhanced-yo… |
CVE-2025-23943 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aruvi PDF.js Shortcode pdfjs-shortcode allows Stored XSS… |
CVE-2025-23941 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in meinturnierplan MeinTurnierplan.de Widget Viewer meinturn… |
CVE-2025-23940 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in horiyuki Image Switcher image-switcher allows Stored XSS… |
CVE-2025-23939 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KHAN-IT Image Switcher image-switcher allows Stored XSS.T… |
CVE-2025-23936 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harun R. Rayhan(thecrazycoder) CC Circle Progress Bar cc-… |
CVE-2025-23935 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fengler Magic Google Maps magic-google-maps allows Stored… |
CVE-2025-23934 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sam Brodie Giveaways and Contests by PromoSimple giveaway… |
CVE-2025-23933 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpfreeware WpF Ultimate Carousel wpf-ultimate-carousel al… |
CVE-2025-23930 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in paypalmuse PayPal Marketing Solutions paypal-promotions-and-insights allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-23929 | Medium | 4.3 | 2025-01-16 | Missing Authorization vulnerability in wishfulthemes Email Capture & Lead Generation email-capture-lead-generation allows Exploiting Incorrectly Configured Acc… |
CVE-2025-23928 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Arsovski Google Org Chart google-org-chart all… |
CVE-2025-23927 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in massimo.serpilli Incredible Font Awesome incredible-font-… |
CVE-2025-23926 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Ajax WP Query Search Filter ajax-wp-query-search-fil… |
CVE-2025-23925 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jp2112 Feedburner Optin Form feedburner-optin-form allows… |
CVE-2025-23924 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeremy WP Photo Sphere wp-photo-sphere allows Stored XSS… |
CVE-2025-23922 | Critical | 10.0 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Harsh iSpring Embedder embed-ispring allows Upload a Web Shell to a Web Server.This issue affects iSpring Em… |
CVE-2025-23919 | Medium | 5.4 | 2025-01-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Ella Van Durpe Slides & Presentations slide allows Code Injectio… |
CVE-2025-23917 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-23916 | Medium | 5.4 | 2025-01-16 | Missing Authorization vulnerability in Nuanced Media WP Meetup wp-meetup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-23915 | High | 7.5 | 2025-01-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Event Lite fat-event-lite… |
CVE-2025-23913 | High | 8.5 | 2025-01-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pankajpragma WordPress Google Map Professional google-map… |
CVE-2025-23912 | High | 8.5 | 2025-01-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Philipp Speck WordPress Custom Sidebar wordpress-custom-s… |
CVE-2025-23911 | High | 8.5 | 2025-01-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in solidres Solidres – Hotel booking plugin solidres allows… |
CVE-2025-23909 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Common Ninja Compare Ninja compare-ninja-comparison-table… |
CVE-2025-23908 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rami Yushuvaev Pastebin pastebin-embed allows Stored XSS… |
CVE-2025-23907 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in closed SOCIAL.NINJA allows Stored XSS. This issue affects… |
CVE-2025-23902 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Taras Dashkevych Error Notification error-notification allows Cross Site Request Forgery.This issue affects… |
CVE-2025-23901 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in cybio GravatarLocalCache gravatarlocalcache allows Cross Site Request Forgery.This issue affects GravatarLoc… |
CVE-2025-23900 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in genkisan Genki Announcement genki-announcement allows Cross Site Request Forgery.This issue affects Genki An… |
CVE-2025-23899 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bookalet Bookalet bookalet allows Stored XSS.This issue a… |
CVE-2025-23898 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-buttons allows Stored XSS.This issue affects Apply… |
CVE-2025-23897 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivobrett Apply with LinkedIn buttons apply-with-linkedin-… |
CVE-2025-23896 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thom4 Mindmeister Shortcode mindmeister-shortcode allows… |
CVE-2025-23895 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Dan Cameron Add RSS add-rss allows Stored XSS.This issue affects Add RSS: from n/a through <= 1.5. |
CVE-2025-23893 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Manny Costales GMap Shortcode gmap-shortcode allows DOM-B… |
CVE-2025-23892 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Furr Progress Tracker progress-tracker allows DOM-Ba… |
CVE-2025-23891 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Loy Yet Another Countdown yacp allows DOM-Based X… |
CVE-2025-23890 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tom Ewer Easy Tweet Embed easy-tweet-embed allows DOM-Bas… |
CVE-2025-23887 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scottwallick Blog Summary blog-summary allows Stored XSS… |
CVE-2025-23886 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Roberts Annie annie allows Stored XSS.This issue af… |
CVE-2025-23884 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Chris Roberts Annie annie allows Cross Site Request Forgery.This issue affects Annie: from n/a through <= 2… |
CVE-2025-23880 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in anmari amr personalise amr-personalise allows Cross Site Request Forgery.This issue affects amr personalise… |
CVE-2025-23878 | Medium | 5.9 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Reilly Post-to-Post Links easy-post-to-post-links a… |
CVE-2025-23877 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nitethemes Nite Shortcodes nite-shortcodes allows Stored… |
CVE-2025-23876 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in No-Nonsense WP krpano wp-krpano allows Stored XSS.This is… |
CVE-2025-23875 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in madeglobal Better Protected Pages better-protected-pages allows Stored XSS.This issue affects Better Protect… |
CVE-2025-23873 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anshi Solutions Category D3 Tree category-d3-tree allows… |
CVE-2025-23872 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in payform PayForm payform allows Stored XSS.This issue affects PayForm: from n/a through <= 2.0. |
CVE-2025-23871 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in Bas Matthee LSD Google Maps Embedder lsd-google-maps-embedder allows Cross Site Request Forgery.This issue a… |
CVE-2025-23870 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in wygk Copyright Safeguard Footer Notice copyright-safeguard-footer-notice allows Stored XSS.This issue affect… |
CVE-2025-23869 | High | 7.1 | 2025-01-16 | Cross-Site Request Forgery (CSRF) vulnerability in shibulijack CJ Custom Content cj-custom-content allows Stored XSS.This issue affects CJ Custom Content: from… |
CVE-2025-23868 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mliebelt Chess Tempo Viewer chesstempoviewer allows Store… |
CVE-2025-23865 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressfore Winning Portfolio winning-portfolio allows Stor… |
CVE-2025-23864 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Luke America WCS QR Code Generator wcs-qr-code-generator… |
CVE-2025-23863 | Medium | 6.5 | 2025-01-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sabaoh Rollover Tab rollover-tab allows Stored XSS.This i… |