2025 CVEs (page 433)
Page 433 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22559 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: fro… |
CVE-2025-22558 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus C. J. Hartmann mcjh button shortcode mcjh-button-s… |
CVE-2025-22557 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publis… |
CVE-2025-22556 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Cross Site Request Forgery.This issue affect… |
CVE-2025-22555 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue… |
CVE-2025-22554 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fdfranklin06 Video Embed Optimizer video-embed-optimizer… |
CVE-2025-22552 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.Thi… |
CVE-2025-22551 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in albedo0 Boot-Modal boot-modal allows Stored XSS.This issu… |
CVE-2025-22550 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Rhoney AddFunc Mobile Detect addfunc-mobile-detect al… |
CVE-2025-22549 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seinoxygen WP Github wp-github allows Stored XSS.This iss… |
CVE-2025-22548 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in frankkoenen ldap_login_password_and_role_manager ldap-log… |
CVE-2025-22547 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jaykrishnang JK Html To Pdf jk-html-to-pdf allows Stored… |
CVE-2025-22546 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows… |
CVE-2025-22545 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored X… |
CVE-2025-22544 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mind Doodle Mind Doodle Visual Sitemaps & Tasks mind-dood… |
CVE-2025-22543 | Medium | 5.4 | 2025-01-07 | Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-22541 | Medium | 5.4 | 2025-01-07 | Missing Authorization vulnerability in etruel WP Delete Post Copies etruel-del-post-copies allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-22538 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in Ofek Nakar Virtual Bot virtual-bot allows Stored XSS.This issue affects Virtual Bot: from n/a through <= 1.0… |
CVE-2025-22536 | High | 7.6 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiren.sabd WP Music Player wp-music-player allows SQL Inj… |
CVE-2025-22534 | Medium | 5.4 | 2025-01-07 | Missing Authorization vulnerability in Ella Van Durpe Slides & Presentations slide allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-22533 | High | 7.6 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bulktheme WOOEXIM wooexim allows SQL Injection.This issue… |
CVE-2025-22532 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Simple Photo Sphere simple-photo-sphere allow… |
CVE-2025-22531 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M Bilal M Urdu Formatter – Shamil urdu-formatter-shamil a… |
CVE-2025-22530 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PORTONE 아임포트 결제버튼 생성 플러그인 iamport-payment allows Stored X… |
CVE-2025-22529 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordpresteem WE Blocks we-blocks allows Stored XSS.This i… |
CVE-2025-22528 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huurkalender.nl Huurkalender WP huurkalender-wp allows St… |
CVE-2025-22525 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bharat Kambariya Donation Block For PayPal donations-bloc… |
CVE-2025-22524 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in formafzar فرم ساز فرم افزار formafzar allows Stored XSS.T… |
CVE-2025-22522 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in roya khosravi SingSong singsong allows Stored XSS.This is… |
CVE-2025-22520 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in Tock Tock Widget tock-widget allows Cross Site Request Forgery.This issue affects Tock Widget: from n/a thro… |
CVE-2025-22519 | High | 8.5 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in jerodmoore eDoc Easy Tables edoc-easy-tables allows SQL I… |
CVE-2025-22518 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Justified Image Gallery justified-image-gall… |
CVE-2025-22517 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson List Pages at Depth list-pages-at-depth allows… |
CVE-2025-22516 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hpinfosys Metadata SEO metadata-seo allows Stored XSS.Thi… |
CVE-2025-22515 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simon Show Google Analytics widget show-google-analytics-… |
CVE-2025-22512 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in BoldGrid Help Scout help-scout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-22511 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ella Van Durpe Slides & Presentations slide allows Stored… |
CVE-2025-22507 | High | 7.6 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in iDo8p WPMU Prefill Post wpmu-prefill-post allows SQL Inje… |
CVE-2025-22503 | Medium | 4.3 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in digitalzoomstudio Admin debug wordpress – enable debug dzs-enable-debug allows Cross Site Request Forgery.Th… |
CVE-2025-22502 | High | 7.6 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mindvalley MindValley Super PageMash mindvalley-pagemash… |
CVE-2025-22338 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lich_wang WP-tagMaker tagmaker allows Reflected XSS.This… |
CVE-2025-22335 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rajib.dewan Opencart Product in WP opencart-product-in-wp… |
CVE-2025-22294 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda Custom Field For WP Job Manager custom-field-… |
CVE-2025-21624 | Critical | 9.8 | 2025-01-07 | ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 239, a file upload vulnerability exists in the Manage Playlist functionality of the… |
CVE-2025-21623 | High | 7.5 | 2025-01-07 | ClipBucket V5 provides open source video hosting with PHP. Prior to 5.5.1 - 238, ClipBucket V5 allows unauthenticated attackers to change the template director… |
CVE-2025-21622 | High | 7.5 | 2025-01-07 | ClipBucket V5 provides open source video hosting with PHP. During the user avatar upload workflow, a user can choose to upload and change their avatar at any t… |
CVE-2025-0298 | Medium | 6.3 | 2025-01-07 | A vulnerability was found in code-projects Online Book Shop 1.0. It has been rated as critical. This issue affects some unknown processing of the file /process… |
CVE-2025-0297 | Medium | 6.3 | 2025-01-07 | A vulnerability was found in code-projects Online Book Shop 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /detail… |
CVE-2025-0247 | Critical | 9.8 | 2025-01-07 | Memory safety bugs present in Firefox 133 and Thunderbird 133. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-0246 | Medium | 6.5 | 2025-01-07 | When using an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other operating sys… |
CVE-2025-0245 | Low | 3.3 | 2025-01-07 | Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed. This vulnerability was fixe… |
CVE-2025-0244 | Medium | 5.3 | 2025-01-07 | When redirecting to an invalid protocol scheme, an attacker could spoof the address bar. *Note: This issue only affected Android operating systems. Other oper… |
CVE-2025-0243 | Medium | 5.1 | 2025-01-07 | Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-0242 | Medium | 6.5 | 2025-01-07 | Memory safety bugs present in Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. Some of these bug… |
CVE-2025-0241 | High | 7.7 | 2025-01-07 | When segmenting specially crafted text, segmentation would corrupt memory leading to a potentially exploitable crash. This vulnerability was fixed in Firefox 1… |
CVE-2025-0240 | Medium | 4.0 | 2025-01-07 | Parsing a JavaScript module as JSON could, under some circumstances, cause cross-compartment access, which may result in a use-after-free. This vulnerability w… |
CVE-2025-0239 | Medium | 4.0 | 2025-01-07 | When using Alt-Svc, ALPN did not properly validate certificates when the original server is redirecting to an insecure site. This vulnerability was fixed in Fi… |
CVE-2025-0238 | Medium | 5.3 | 2025-01-07 | Assuming a controlled failed memory allocation, an attacker could have caused a use-after-free, leading to a potentially exploitable crash. This vulnerability… |
CVE-2025-0237 | Medium | 5.4 | 2025-01-07 | The WebChannel API, which is used to transport various information across processes, did not check the sending principal but rather accepted the principal bein… |
CVE-2025-0296 | Medium | 6.3 | 2025-01-07 | A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. Th… |
CVE-2025-0295 | Low | 3.5 | 2025-01-07 | A vulnerability was found in code-projects Online Book Shop 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file… |
CVE-2025-0294 | Medium | 4.7 | 2025-01-07 | A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vulnerability is an unk… |
CVE-2025-22364 | High | 7.5 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Service Shogun Ach Invoice App ach-inv… |
CVE-2025-22362 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Bakovic WPAchievements Free wpachievements-free al… |
CVE-2025-22359 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pjfc SyncFields syncfields allows Reflected XSS.This issu… |
CVE-2025-22358 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simone Marcon Wp advertising management advertising-manag… |
CVE-2025-22357 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever Target Notifications target-notifications allows… |
CVE-2025-22355 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in asokaaso2 Kikx Simple Post Author Filter sa-post-author-f… |
CVE-2025-22353 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bvads BVD Easy Gallery Manager bvd-easy-gallery-manager a… |
CVE-2025-22352 | High | 7.6 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products… |
CVE-2025-22351 | High | 7.6 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in penguinarts Contact Form 7 Database – CFDB7 advanced-cf7-… |
CVE-2025-22349 | High | 7.6 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Marka WordPress Auction Plugin wp-auctions allows SQL… |
CVE-2025-22348 | High | 8.5 | 2025-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in rtowebsites DynamicTags dynamictags allows Blind SQL Inje… |
CVE-2025-22347 | High | 8.2 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in bannersky BSK Forms Blacklist bsk-gravityforms-blacklist allows Blind SQL Injection.This issue affects BSK F… |
CVE-2025-22343 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in koter84 wpSOL wpsol allows Stored XSS.This issue affects wpSOL: from n/a through <= 1.2.0. |
CVE-2025-22342 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in Jenst WP Simple Sitemap wp-simple-sitemap allows Stored XSS.This issue affects WP Simple Sitemap: from n/a t… |
CVE-2025-22339 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in athemeart Store Commerce store-commerce allows DOM-Based… |
CVE-2025-22336 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in Amos Lee（一刀） Wizhi Multi Filters by Wenprise wizhi-multi-filters allows Stored XSS.This issue affects Wizhi… |
CVE-2025-22333 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in piotnetdotcom Piotnet Addons For Elementor piotnet-addons… |
CVE-2025-22328 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in Elevio by Dixa Elevio elevio allows Stored XSS.This issue affects Elevio: from n/a through <= 4.4.1. |
CVE-2025-22327 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer EO4WP fw-integration-for-emailoctopus allows… |
CVE-2025-22326 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5centsCDN 5centsCDN 5centscdn allows Reflected XSS.This i… |
CVE-2025-22325 | High | 7.1 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in nchankov Autocompleter autocompleter allows Stored XSS.This issue affects Autocompleter: from n/a through <=… |
CVE-2025-22324 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andon Ivanov OZ Canonical oz-canonical allows Reflected X… |
CVE-2025-22323 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Image Hover Effects for Elementor image-hove… |
CVE-2025-22321 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TheInnovs ElementsCSS Addons for Elementor css-for-elemen… |
CVE-2025-22320 | High | 7.1 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ProductDyno ProductDyno productdyno allows Reflected XSS… |
CVE-2025-22316 | Medium | 5.9 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-ad… |
CVE-2025-22315 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Typing Text typing-text allows Stored XSS.Thi… |
CVE-2025-22312 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows DO… |
CVE-2025-22310 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in marsian TemplatesNext ToolKit templatesnext-toolkit allow… |
CVE-2025-22309 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RopeSwingHld SpeakOut! Email Petitions speakout allows DO… |
CVE-2025-22308 | Medium | 6.5 | 2025-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Takashi Kitajima Smart Custom Fields smart-custom-fields… |
CVE-2025-22305 | Medium | 6.5 | 2025-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Essential Plugin Hero Banner Ultimate… |
CVE-2025-22304 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-22303 | Medium | 5.3 | 2025-01-07 | Insertion of Sensitive Information Into Sent Data vulnerability in brandtoss WP Mailster wp-mailster allows Retrieve Embedded Sensitive Data.This issue affects… |
CVE-2025-22302 | Medium | 5.3 | 2025-01-07 | Missing Authorization vulnerability in WP Grids WP Wand ai-content-generation allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-22301 | Medium | 5.4 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in zookatron MyBookTable Bookstore mybooktable allows Cross Site Request Forgery.This issue affects MyBookTable… |
CVE-2025-22300 | Medium | 5.4 | 2025-01-07 | Cross-Site Request Forgery (CSRF) vulnerability in PixelYourSite PixelYourSite – Your smart PIXEL (TAG) Manager pixelyoursite allows Cross Site Request Forgery… |
CVE-2025-22299 | Medium | 4.3 | 2025-01-07 | Missing Authorization vulnerability in Space Codes AI for SEO ai-for-seo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |