2025 CVEs (page 54)
Page 54 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-69092 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPDeveloper Essential Addons for Elementor essential-addo… |
CVE-2025-69091 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-69089 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in autolistings Auto Listings auto-listings allows Stored XS… |
CVE-2025-69088 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vidish Combo Offers WooCommerce woo-combo-offers allows D… |
CVE-2025-69034 | High | 8.1 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Lekker lekker allows PHP… |
CVE-2025-69033 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A WP Life Blog Filter blog-filter allows DOM-Based XSS.Th… |
CVE-2025-69032 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-69031 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arca… |
CVE-2025-69030 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Acc… |
CVE-2025-69029 | Medium | 5.4 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-69028 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weFo… |
CVE-2025-69027 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting… |
CVE-2025-69026 | Medium | 4.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensit… |
CVE-2025-69025 | Medium | 4.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.Th… |
CVE-2025-69024 | Medium | 6.5 | 2025-12-30 | Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-69023 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-69022 | Medium | 5.4 | 2025-12-30 | Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Acce… |
CVE-2025-69021 | Medium | 5.4 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a thr… |
CVE-2025-69020 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows St… |
CVE-2025-69019 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based X… |
CVE-2025-69018 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM… |
CVE-2025-69017 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This… |
CVE-2025-69016 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in averta Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-69015 | Low | 3.8 | 2025-12-30 | Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-69014 | Medium | 4.9 | 2025-12-30 | Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <=… |
CVE-2025-69013 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects S… |
CVE-2025-69012 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-69010 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-69009 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-69008 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allo… |
CVE-2025-69007 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-side… |
CVE-2025-69006 | Medium | 5.9 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This is… |
CVE-2025-68998 | Medium | 5.4 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affec… |
CVE-2025-68997 | Medium | 5.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68996 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carous… |
CVE-2025-68995 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68994 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68993 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly… |
CVE-2025-68992 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allow… |
CVE-2025-68991 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager a… |
CVE-2025-68990 | High | 8.5 | 2025-12-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager a… |
CVE-2025-68989 | Medium | 4.3 | 2025-12-30 | Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows R… |
CVE-2025-68988 | Medium | 5.3 | 2025-12-30 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Em… |
CVE-2025-68987 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Cinerama cinerama allows P… |
CVE-2025-68985 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Aora aora allows PHP Local Fil… |
CVE-2025-68984 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Puca puca allows PHP Local Fil… |
CVE-2025-68983 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP… |
CVE-2025-68982 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-68981 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-68980 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-68979 | Medium | 5.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Co… |
CVE-2025-68978 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows D… |
CVE-2025-68977 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-po… |
CVE-2025-68976 | Medium | 5.4 | 2025-12-30 | Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-68975 | Medium | 4.3 | 2025-12-30 | Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-68974 | Medium | 6.6 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and… |
CVE-2025-15245 | Low | 3.5 | 2025-12-30 | A vulnerability was found in D-Link DCS-850L 1.02.09. Affected is the function uploadfirmware of the component Firmware Update Service. The manipulation of the… |
CVE-2025-15244 | Low | 3.7 | 2025-12-30 | A vulnerability has been found in PHPEMS up to 11.0. This impacts an unknown function of the component Purchase Request Handler. The manipulation leads to race… |
CVE-2025-15359 | Critical | 9.1 | 2025-12-30 | DVP-12SE11T - Out-of-bound memory write Vulnerability |
CVE-2025-15243 | High | 7.3 | 2025-12-30 | A flaw has been found in code-projects Simple Stock System 1.0. This affects an unknown function of the file /market/login.php. Executing a manipulation of the… |
CVE-2025-15242 | Low | 3.1 | 2025-12-30 | A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function of the component Coupon Handler. Performing a manipulation resul… |
CVE-2025-15358 | High | 7.5 | 2025-12-30 | DVP-12SE11T - Denial of Service Vulnerability |
CVE-2025-15241 | Low | 3.5 | 2025-12-30 | A security vulnerability has been detected in CloudPanel Community Edition up to 2.5.1. The affected element is an unknown function of the file /admin/users of… |
CVE-2025-15234 | High | 8.8 | 2025-12-30 | A weakness has been identified in Tenda M3 1.0.0.13(4903). Impacted is the function formSetRemoteInternetLanInfo of the file /goform/setInternetLanInfo. This m… |
CVE-2025-15103 | High | 8.1 | 2025-12-30 | DVP-12SE11T - Authentication Bypass via Partial Password Disclosure |
CVE-2025-15102 | Critical | 9.1 | 2025-12-30 | DVP-12SE11T - Password Protection Bypass |
CVE-2025-15355 | Medium | 6.1 | 2025-12-30 | ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrar… |
CVE-2025-15233 | High | 8.8 | 2025-12-30 | A security flaw has been discovered in Tenda M3 1.0.0.13(4903). This issue affects the function formSetAdInfoDetails of the file /goform/setAdInfoDetail. The m… |
CVE-2025-15232 | High | 8.8 | 2025-12-30 | A vulnerability was identified in Tenda M3 1.0.0.13(4903). This vulnerability affects the function formSetAdPushInfo of the file /goform/setAdPushInfo. The man… |
CVE-2025-15231 | High | 8.8 | 2025-12-30 | A vulnerability was determined in Tenda M3 1.0.0.13(4903). This affects the function formSetRemoteVlanInfo of the file /goform/setVlanInfo. Executing a manipul… |
CVE-2025-15230 | High | 8.8 | 2025-12-30 | A vulnerability was found in Tenda M3 1.0.0.13(4903). Affected by this issue is the function formSetVlanPolicy of the file /goform/setVlanPolicyData. Performin… |
CVE-2025-15229 | Medium | 5.3 | 2025-12-30 | A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClien… |
CVE-2025-15222 | Medium | 5.0 | 2025-12-30 | A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateF… |
CVE-2025-14313 | Medium | 6.1 | 2025-12-30 | The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a… |
CVE-2025-14312 | Medium | 6.1 | 2025-12-30 | The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a… |
CVE-2025-15221 | Low | 3.5 | 2025-12-30 | A flaw has been found in SohuTV CacheCloud up to 3.2.0. This vulnerability affects the function index of the file src/main/java/com/sohu/cache/web/controller/A… |
CVE-2025-15220 | Medium | 4.3 | 2025-12-30 | A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginCont… |
CVE-2025-15219 | Low | 3.5 | 2025-12-30 | A security vulnerability has been detected in SohuTV CacheCloud up to 3.2.0. Affected by this issue is the function doMachineList/doPodList of the file src/mai… |
CVE-2025-15218 | High | 8.8 | 2025-12-30 | A weakness has been identified in Tenda AC10U 15.03.06.48/15.03.06.49. Affected by this vulnerability is the function fromadvsetlanip of the file /goform/AdvSe… |
CVE-2025-15217 | High | 8.8 | 2025-12-30 | A security flaw has been discovered in Tenda AC23 16.03.07.52. Affected is the function formSetPPTPUserList of the component HTTP POST Request Handler. Perform… |
CVE-2025-15216 | High | 8.8 | 2025-12-30 | A vulnerability was identified in Tenda AC23 16.03.07.52. This impacts the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the… |
CVE-2025-15215 | High | 8.8 | 2025-12-30 | A vulnerability was determined in Tenda AC10U 15.03.06.48/15.03.06.49. This affects the function formSetPPTPUserList of the file /goform/setPptpUserList of the… |
CVE-2025-69235 | High | 7.5 | 2025-12-30 | Whale browser before 4.35.351.12 allows an attacker to bypass the Same-Origin Policy in a sidebar environment. |
CVE-2025-69234 | Critical | 9.1 | 2025-12-30 | Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment. |
CVE-2025-15214 | Low | 2.4 | 2025-12-30 | A vulnerability was found in Campcodes Park Ticketing System 1.0. The impacted element is the function save_pricing of the file admin_class.php. The manipulati… |
CVE-2025-69217 | High | 7.7 | 2025-12-30 | coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port r… |
CVE-2025-15213 | Medium | 4.3 | 2025-12-30 | A vulnerability has been found in code-projects Student File Management System 1.0. The affected element is an unknown function of the file /download.php of th… |
CVE-2025-15212 | Medium | 6.3 | 2025-12-30 | A vulnerability was detected in code-projects Refugee Food Management System 1.0. This issue affects some unknown processing of the file /home/regfood.php. Per… |
CVE-2025-15211 | Medium | 6.3 | 2025-12-30 | A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulatio… |
CVE-2025-68499 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This iss… |
CVE-2025-68498 | Medium | 6.5 | 2025-12-30 | Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects J… |
CVE-2025-68120 | Medium | 5.4 | 2025-12-30 | To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode. |
CVE-2025-68040 | Medium | 6.5 | 2025-12-30 | Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-68036 | High | 7.5 | 2025-12-30 | Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2025-23554 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakub Glos Off Page SEO off-page-seo allows Reflected XSS… |
CVE-2025-23550 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemal YAZICI Product Puller product-puller allows Reflect… |
CVE-2025-23469 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sleekplan Sleekplan sleekplan allows Reflected XSS.This i… |
CVE-2025-23458 | High | 7.1 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rakessh Ads24 Lite wp-ad-management allows Reflected XSS… |
CVE-2025-15210 | Medium | 6.3 | 2025-12-30 | A security vulnerability has been detected in code-projects Refugee Food Management System 1.0. This vulnerability affects unknown code of the file /home/editr… |
CVE-2025-15284 | Low | 3.7 | 2025-12-29 | Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1. Summary The arrayLimit option in qs did not e… |