2025 CVEs (page 47)
Page 47 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14891 | Medium | 6.4 | 2026-01-07 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, a… |
CVE-2025-14888 | Medium | 4.4 | 2026-01-07 | The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and includin… |
CVE-2025-14887 | Medium | 4.4 | 2026-01-07 | The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all ve… |
CVE-2025-14875 | Medium | 6.1 | 2026-01-07 | The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up… |
CVE-2025-14867 | Medium | 6.5 | 2026-01-07 | The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shor… |
CVE-2025-14845 | Medium | 4.3 | 2026-01-07 | The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due… |
CVE-2025-14842 | Medium | 6.1 | 2026-01-07 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up… |
CVE-2025-14835 | High | 7.1 | 2026-01-07 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including… |
CVE-2025-14804 | High | 7.7 | 2026-01-07 | The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, su… |
CVE-2025-14802 | Medium | 5.4 | 2026-01-07 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v… |
CVE-2025-14796 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image titles in all versions up to, and including, 1.0.4. This is du… |
CVE-2025-14792 | Medium | 4.4 | 2026-01-07 | The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in all versions up to… |
CVE-2025-14719 | Medium | 4.9 | 2026-01-07 | The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a S… |
CVE-2025-14631 | Medium | 6.5 | 2026-01-07 | A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by trigger… |
CVE-2025-14626 | Medium | 6.4 | 2026-01-07 | The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortc… |
CVE-2025-14625 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Window… |
CVE-2025-14614 | Medium | 6.7 | 2026-01-07 | Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows… |
CVE-2025-14468 | Medium | 4.3 | 2026-01-07 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due… |
CVE-2025-14465 | Medium | 4.3 | 2026-01-07 | The Sticky Action Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or… |
CVE-2025-14460 | Medium | 5.3 | 2026-01-07 | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modification in all versions up to, and including… |
CVE-2025-14453 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style_css' shortcode attribute in all versions up to, and inclu… |
CVE-2025-14370 | Medium | 4.3 | 2026-01-07 | The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorizatio… |
CVE-2025-14352 | Medium | 5.3 | 2026-01-07 | The Awesome Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to incorrect authorization in the room-single.php shortco… |
CVE-2025-14147 | Medium | 6.4 | 2026-01-07 | The Easy GitHub Gist Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the gist shortcode in all versions… |
CVE-2025-14145 | Medium | 6.4 | 2026-01-07 | The Niche Hero | Beautifully-designed blocks in seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spacing' parameter of the nh… |
CVE-2025-14144 | Medium | 6.4 | 2026-01-07 | The Mstoic Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'start' parameter of the ms_youtube_embeds shortcode in all ver… |
CVE-2025-14131 | Medium | 6.1 | 2026-01-07 | The WP Widget Changer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14130 | Medium | 6.1 | 2026-01-07 | The Post Like Dislike plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14128 | Medium | 6.1 | 2026-01-07 | The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14127 | Medium | 6.1 | 2026-01-07 | The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-14122 | Medium | 6.4 | 2026-01-07 | The AD Sliding FAQ plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sliding_faq' shortcode in all versions up to, and including, 2.4… |
CVE-2025-14121 | Medium | 6.4 | 2026-01-07 | The EDD Download Info plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'edd_download_info_link' shortcode in all versions up to, and i… |
CVE-2025-14118 | Medium | 6.1 | 2026-01-07 | The Starred Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the PHP_SELF variable in all versions up to, and including, 1.4.2 d… |
CVE-2025-14114 | Medium | 6.4 | 2026-01-07 | The 1180px Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, and includin… |
CVE-2025-14113 | Medium | 6.4 | 2026-01-07 | The Viitor Button Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' shortcode attribute in all versions up to, and in… |
CVE-2025-14112 | Medium | 6.4 | 2026-01-07 | The Snillrik Restaurant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'menu_style' shortcode attribute in all versions up to, and i… |
CVE-2025-14110 | Medium | 6.4 | 2026-01-07 | The WP Js List Pages Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class' shortcode attribute in all versions up to, an… |
CVE-2025-14109 | Medium | 6.4 | 2026-01-07 | The AH Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'column' shortcode attribute in all versions up to, and including… |
CVE-2025-14077 | Medium | 4.3 | 2026-01-07 | The Simcast plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect n… |
CVE-2025-14070 | High | 7.5 | 2026-01-07 | The Reviewify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'send_test_email' AJAX action in… |
CVE-2025-14059 | Medium | 6.5 | 2026-01-07 | The EmailKit plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.6.1. This is due to missing p… |
CVE-2025-14057 | Medium | 4.4 | 2026-01-07 | The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 17.0.39 due… |
CVE-2025-14053 | Medium | 6.4 | 2026-01-07 | The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to in… |
CVE-2025-14028 | Medium | 4.4 | 2026-01-07 | The Contact Us Simple Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due t… |
CVE-2025-13990 | Medium | 4.3 | 2026-01-07 | The Mamurjor Employee Info plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing… |
CVE-2025-13974 | Medium | 4.4 | 2026-01-07 | The Email Customizer for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email template content in all versions up to, and in… |
CVE-2025-13887 | Medium | 6.4 | 2026-01-07 | The AI BotKit – AI Chatbot & Live Support for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the `ai_bot… |
CVE-2025-13849 | Medium | 6.4 | 2026-01-07 | The Cool YT Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'videoid' parameter in all versions up to, and including, 1.0 due… |
CVE-2025-13848 | Medium | 6.4 | 2026-01-07 | The STM Gallery 1.9 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'composicion' parameter in all versions up to, and including, 0.9… |
CVE-2025-13847 | Medium | 6.4 | 2026-01-07 | The PhotoFade plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'time' parameter in all versions up to, and including, 0.2.1 due to ins… |
CVE-2025-13841 | Medium | 6.4 | 2026-01-07 | The Smart App Banners plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'size' and 'verticalalign' parameters of the 'app-store-downloa… |
CVE-2025-13801 | High | 7.5 | 2026-01-07 | The Yoco Payments plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 3.9.0 via the file parameter. This makes it possib… |
CVE-2025-13722 | Medium | 5.3 | 2026-01-07 | The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Missing Authorization in all v… |
CVE-2025-13694 | Medium | 5.3 | 2026-01-07 | The AA Block Country plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 1.0.1. This is due to the plugin trusting user… |
CVE-2025-13667 | Medium | 6.4 | 2026-01-07 | The WP Recipe Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Skill Level' input field in all versions up to, and including… |
CVE-2025-13657 | Medium | 4.3 | 2026-01-07 | The HelpDesk contact form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.5. This is due to missing… |
CVE-2025-13531 | Medium | 6.4 | 2026-01-07 | The Stylish Order Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'product_name' parameter in all versions up to, and in… |
CVE-2025-13529 | Medium | 5.3 | 2026-01-07 | The Unify plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'init' action in all versions up to… |
CVE-2025-13527 | Medium | 4.3 | 2026-01-07 | The xShare plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce validatio… |
CVE-2025-13521 | Medium | 4.3 | 2026-01-07 | The WP Status Notifier plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or in… |
CVE-2025-13520 | Medium | 4.3 | 2026-01-07 | The MTCaptcha WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.2. This is due to missing or… |
CVE-2025-13519 | Medium | 6.1 | 2026-01-07 | The SVG Map Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or inco… |
CVE-2025-13497 | Medium | 6.4 | 2026-01-07 | The Recras WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'recrasname' shortcode attribute in all versions up to, and incl… |
CVE-2025-13496 | Medium | 5.3 | 2026-01-07 | The Moosend Landing Pages plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the moosend_landings_aut… |
CVE-2025-13493 | High | 7.5 | 2026-01-07 | The Latest Registered Users plugin for WordPress is vulnerable to unauthorized user data export in all versions up to, and including, 1.4. This is due to missi… |
CVE-2025-13419 | Medium | 5.3 | 2026-01-07 | The Guest posting / Frontend Posting / Front Editor – WP Front User Submit plugin for WordPress is vulnerable to unauthorized modification of data due to a mis… |
CVE-2025-13418 | Medium | 6.4 | 2026-01-07 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'plan_icons' parameter in all versions up to, and includ… |
CVE-2025-13371 | High | 8.6 | 2026-01-07 | The MoneySpace plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.13.9. This is due to the plugin sto… |
CVE-2025-13369 | Medium | 6.1 | 2026-01-07 | The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'money_spent_from', 'money_spent_to'… |
CVE-2025-12958 | Low | 2.7 | 2026-01-07 | The Rankology SEO and Analytics Tool plugin for WordPress is vulnerable to unauthorized modification of data due to an incorrect capability check on the 'ranko… |
CVE-2025-12648 | Medium | 5.3 | 2026-01-07 | The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user… |
CVE-2025-12540 | Medium | 4.7 | 2026-01-07 | The ShareThis Dashboard for Google Analytics plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.2.4… |
CVE-2025-12449 | Medium | 5.4 | 2026-01-07 | The aBlocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data and disclosure of sensitive information due to… |
CVE-2025-12030 | Medium | 4.3 | 2026-01-07 | The ACF to REST API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.3.4. This is due to insuffic… |
CVE-2025-11877 | High | 7.5 | 2026-01-07 | The User Activity Log plugin is vulnerable to a limited options update in versions up to, and including, 2.2. The failed-login handler 'ual_shook_wp_login_fail… |
CVE-2025-11235 | Low | 3.7 | 2026-01-07 | Unverified Password Change vulnerability in Progress MOVEit Transfer on Windows (REST API modules).This issue affects MOVEit Transfer: from 2023.1.0 before 202… |
CVE-2025-0980 | Medium | 6.4 | 2026-01-07 | Nokia SR Linux is vulnerable to an authentication vulnerability allowing unauthorized access to the JSON-RPC service. When exploited, an invalid validation al… |
CVE-2025-31642 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dasinfomedia WPCHURCH allows Reflected XSS.This issue aff… |
CVE-2025-31051 | Medium | 5.3 | 2026-01-07 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in EngoTheme Plant - Gardening & Houseplants WordPress Theme allows Re… |
CVE-2025-15471 | Critical | 9.8 | 2026-01-07 | A vulnerability was detected in TRENDnet TEW-713RE 1.02. The impacted element is an unknown function of the file /goformX/formFSrvX. The manipulation of the ar… |
CVE-2025-14612 | Medium | 6.7 | 2026-01-07 | Insecure Temporary File vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows : Use of Predictable File Names.This issue affects Quar… |
CVE-2025-14605 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro on Windows (System Console modules) allows Search Order Hijacking.This issue affects… |
CVE-2025-14599 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on… |
CVE-2025-14596 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Pro Installer (SFX) on Windows allows Search Order Hijacking.This issue affects Quar… |
CVE-2025-30996 | Critical | 9.9 | 2026-01-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Sidepane WordPress Theme, Themify Themify Newsy, Themify Themify Folo, Themify… |
CVE-2025-30631 | High | 7.1 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA-Team Woocommerce Sales Funnel Builder, AA-Team Amazon… |
CVE-2025-29004 | High | 8.8 | 2026-01-06 | Incorrect Privilege Assignment vulnerability in AA-Team Premium Age Verification / Restriction for WordPress, AA-Team Responsive Coming Soon Landing Page / Hol… |
CVE-2025-13744 | Medium | 5.4 | 2026-01-06 | An Improper Neutralization of Input During Web Page Generation vulnerability was identified in GitHub Enterprise Server that allowed attacker controlled HTML t… |
CVE-2025-7048 | Medium | 4.3 | 2026-01-06 | On affected platforms running Arista EOS with MACsec configuration, a specially crafted packet can cause the MACsec process to terminate unexpectedly. Continuo… |
CVE-2025-32304 | High | 8.1 | 2026-01-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mojoomla WPCHURCH allows PHP Local Fil… |
CVE-2025-15382 | High | 8.1 | 2026-01-06 | A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted… |
CVE-2025-14942 | Critical | 9.8 | 2026-01-06 | wolfSSH’s key exchange state machine can be manipulated to leak the client’s password in the clear, trick the client to send a bogus signature, or trick the cl… |
CVE-2025-69364 | Medium | 5.3 | 2026-01-06 | Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breez… |
CVE-2025-69363 | Medium | 6.5 | 2026-01-06 | Missing Authorization vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Exploiting Incorrectly Configured Acc… |
CVE-2025-69362 | Medium | 5.9 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH UiChemy uichemy allows Stored XSS.This issue aff… |
CVE-2025-69361 | Medium | 4.3 | 2026-01-06 | Missing Authorization vulnerability in PublishPress Post Expirator post-expirator allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-69360 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-e… |
CVE-2025-69359 | Medium | 5.3 | 2026-01-06 | Missing Authorization vulnerability in WPFunnels Creator LMS creatorlms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-69357 | Medium | 6.5 | 2026-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) thegem-… |
CVE-2025-69356 | High | 7.5 | 2026-01-06 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for… |