2025 CVEs (page 54)
Page 54 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59136 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Dat… |
CVE-2025-59130 | Medium | 4.3 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in appointify Appointify appointify allows Cross Site Request Forgery.This issue affects Appointify: from n/a t… |
CVE-2025-49356 | Medium | 4.3 | 2025-12-31 | Missing Authorization vulnerability in Mykola Lukin Orders Chat for WooCommerce orders-chat-for-woocommerce allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-49338 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Flowbox Flowbox flowbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flowb… |
CVE-2025-49334 | Medium | 5.3 | 2025-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-15390 | Medium | 6.3 | 2025-12-31 | A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in… |
CVE-2025-63053 | Medium | 5.3 | 2025-12-31 | Authorization Bypass Through User-Controlled Key vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Exploiting Incorrectly Configur… |
CVE-2025-63031 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in WP Grids EasyTest convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-63022 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in topdevs.net Simple Like Page simple-facebook-plugin allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-63016 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in quadlayers QuadLayers TikTok Feed wp-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-63001 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-62888 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62147 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in nikmelnik Realbig realbig-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-62145 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in NewClarity DMCA Protection Badge dmca-badge allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62141 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Information Technology Wawp automation-web-platform allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-62139 | Medium | 5.3 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Retrieve Embedded Sensitive… |
CVE-2025-62108 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62098 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-62091 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Expl… |
CVE-2025-62081 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorr… |
CVE-2025-49349 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in Reuters News Agency Reuters Direct reuters-direct allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-63020 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wayne Allen Postie postie allows Stored XSS.This issue af… |
CVE-2025-62750 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filipe Seabra WooCommerce Parcelas woocommerce-parcelas a… |
CVE-2025-62149 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Stored… |
CVE-2025-62144 | Medium | 5.4 | 2025-12-31 | Missing Authorization vulnerability in Mohammed Kaludi Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster allows Exploiting Incorrectly Conf… |
CVE-2025-62142 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicashmu Post Video Players video-playlist-and-gallery-pl… |
CVE-2025-62140 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stor… |
CVE-2025-62138 | Medium | 5.3 | 2025-12-31 | Missing Authorization vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-62134 | Medium | 5.4 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects C… |
CVE-2025-62124 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soli WP Post Signature wp-post-signature allows Stored XS… |
CVE-2025-62121 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , C… |
CVE-2025-62120 | Medium | 5.4 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Rick Beckman OpenHook thesis-openhook allows Cross Site Request Forgery.This issue affects OpenHook: from n/… |
CVE-2025-62119 | Medium | 5.9 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ViitorCloud Technologies Pvt Ltd Add Featured Image Custo… |
CVE-2025-62117 | Medium | 5.4 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Jayce53 EasyIndex easyindex allows Cross Site Request Forgery.This issue affects EasyIndex: from n/a through… |
CVE-2025-62097 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seothemes SEO Slider seo-slider allows DOM-Based XSS.This… |
CVE-2025-62096 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Maximum Products per User for WooCommerce maxim… |
CVE-2025-62095 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in neilgee Bootstrap Modals bootstrap-modals allows Stored X… |
CVE-2025-59003 | Medium | 5.8 | 2025-12-31 | Insertion of Sensitive Information Into Sent Data vulnerability in inkthemescom ColorWay colorway allows Retrieve Embedded Sensitive Data.This issue affects Co… |
CVE-2025-62990 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Beaver Builder addons-for-be… |
CVE-2025-62744 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Steman Page Title Splitter page-title-splitter allo… |
CVE-2025-62743 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable allows Stored… |
CVE-2025-62742 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Curator.io Curator.io curatorio allows Stored XSS.This is… |
CVE-2025-62125 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anshul Gangrade Custom Background Changer custom-backgrou… |
CVE-2025-62118 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kcseopro AdWords Conversion Tracking Code adwords-convers… |
CVE-2025-62111 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Extra Shortcodes extra-shortcodes allows Stored… |
CVE-2025-49357 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in audiomack Audiomack audiomack allows Stored XSS.This issu… |
CVE-2025-63032 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Consulting consulting allows Stored XSS.Thi… |
CVE-2025-62991 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Minamaze minamaze allows Stored XSS.This is… |
CVE-2025-62757 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebMan Design | Oliver Juhas WebMan Amplifier webman-ampl… |
CVE-2025-62756 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lvaudore The Moneytizer the-moneytizer allows DOM-Based X… |
CVE-2025-62752 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kalender.digital Kalender.digital kalender-digital allows… |
CVE-2025-62749 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bainternet User Specific Content user-specific-content al… |
CVE-2025-62748 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Products Web and WooCommerce Addons for WPBakery… |
CVE-2025-62135 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in landwire Responsive Block Control responsive-block-contro… |
CVE-2025-49358 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ruhul Amin Content Fetcher content-fetcher allows DOM-Bas… |
CVE-2025-15389 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |
CVE-2025-63005 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas WordPress Tooltips wordpress-tooltips allows Stored… |
CVE-2025-63000 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress a… |
CVE-2025-62992 | Medium | 6.5 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Path Traversal.This issue affects Everest Backup: from n/… |
CVE-2025-62761 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BasePress Knowledge Base documentation & wiki plugin – Ba… |
CVE-2025-62760 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode bp-activity-shortc… |
CVE-2025-62759 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Series series allows Stored XSS.This issue… |
CVE-2025-62758 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Funnelforms Funnelforms Free funnelforms-free allows DOM-… |
CVE-2025-62146 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks mx-time-zone-clocks allo… |
CVE-2025-62137 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shuttlethemes Shuttle shuttle allows Stored XSS.This issu… |
CVE-2025-62136 | Medium | 6.5 | 2025-12-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Melos melos allows Stored XSS.This issue af… |
CVE-2025-49028 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Zoho Mail Zoho ZeptoMail transmail allows Stored XSS.This issue affects Zoho ZeptoMail: from n/a through <=… |
CVE-2025-15388 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |
CVE-2025-15387 | High | 8.8 | 2025-12-31 | VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user sessi… |
CVE-2025-2026 | | 2025-12-31 | The NPort 6100-G2/6200-G2 Series is affected by a high-severity vulnerability (CVE-2025-2026) that allows remote attackers to execute a null byte injection thr… | |
CVE-2025-1977 | | 2025-12-31 | The NPort 6100-G2/6200-G2 Series is affected by an execution with unnecessary privileges vulnerability (CVE-2025-1977) that allows an authenticated user with r… | |
CVE-2025-15017 | | 2025-12-31 | A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device c… | |
CVE-2025-15280 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2025-15279 | High | 7.8 | 2025-12-31 | FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-15278 | High | 7.8 | 2025-12-31 | FontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-15277 | High | 7.8 | 2025-12-31 | FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-15276 | High | 7.8 | 2025-12-31 | FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-15275 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-15274 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-15273 | High | 8.8 | 2025-12-31 | FontForge PFB File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-15272 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-15271 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-15270 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-15269 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2025-14783 | Medium | 4.3 | 2025-12-31 | The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient… |
CVE-2025-69277 | Medium | 4.5 | 2025-12-31 | libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles check… |
CVE-2025-68885 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status… |
CVE-2025-49354 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Mindstien Technologies Recent Posts From Each Category recent-posts-from-each-category allows Stored XSS.Thi… |
CVE-2025-49353 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path noindex-by-path allows Stored XSS.This issue affects Noindex by Path: from n/a… |
CVE-2025-49345 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through… |
CVE-2025-49344 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in reneade SensitiveTagCloud sensitive-tag-cloud allows Stored XSS.This issue affects SensitiveTagCloud: from n… |
CVE-2025-49343 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in socialprofilr Social Profilr social-profilr-display-social-network-profile allows Stored XSS.This issue affe… |
CVE-2025-49342 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in merzedes Custom Style custom-style allows Stored XSS.This issue affects Custom Style: from n/a through <= 1… |
CVE-2025-14434 | Medium | 5.3 | 2025-12-31 | The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts with… |
CVE-2025-13029 | High | 7.5 | 2025-12-31 | The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attack… |
CVE-2025-59137 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects… |
CVE-2025-49346 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple… |
CVE-2025-15375 | Medium | 6.3 | 2025-12-31 | A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component… |
CVE-2025-15374 | Low | 3.5 | 2025-12-31 | A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php of the component As… |
CVE-2025-15373 | Medium | 6.3 | 2025-12-31 | A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation… |