2025 CVEs (page 58)
Page 58 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68596 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Bit Apps Bit Assist bit-assist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-68595 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-68594 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Opinion Stage Poll, Survey & Quiz Maker Plugin by Opinion Stage social-polls-by-opinionstage allows Exploiting Incorrect… |
CVE-2025-68593 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-68592 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-68591 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-68590 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CRM Perks Integration for Contact Form 7 HubSpot cf7-hubs… |
CVE-2025-68589 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-68588 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS… |
CVE-2025-68587 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz… |
CVE-2025-68586 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooke… |
CVE-2025-68585 | Low | 2.7 | 2025-12-24 | Missing Authorization vulnerability in Ben Balter WP Document Revisions wp-document-revisions allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-68584 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This iss… |
CVE-2025-68583 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affec… |
CVE-2025-68582 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-68581 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-68580 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Re… |
CVE-2025-68579 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-68578 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Addonify Addonify addonify-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-68577 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Vi… |
CVE-2025-68576 | Medium | 4.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data… |
CVE-2025-68575 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68574 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-v… |
CVE-2025-68573 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue… |
CVE-2025-68572 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-68571 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-68570 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivatesync-trade allows… |
CVE-2025-68569 | Medium | 6.5 | 2025-12-24 | Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-68568 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Ac… |
CVE-2025-68567 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue af… |
CVE-2025-68566 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edit… |
CVE-2025-68565 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in JayBee Twitch Player ttv-easy-embed-player allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68563 | High | 7.5 | 2025-12-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Unlock Lite su… |
CVE-2025-68540 | High | 7.5 | 2025-12-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Fana fana allows PHP Local Fil… |
CVE-2025-68537 | High | 7.5 | 2025-12-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Zota zota allows PHP Local Fil… |
CVE-2025-68535 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-68533 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This is… |
CVE-2025-68532 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor m… |
CVE-2025-68530 | High | 7.5 | 2025-12-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pavothemes Bookory bookory allows PHP… |
CVE-2025-68529 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email C… |
CVE-2025-68528 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shippin… |
CVE-2025-68527 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC Academy LMS academy allows Stored XSS.This is… |
CVE-2025-68525 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS… |
CVE-2025-68523 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-68522 | Medium | 4.3 | 2025-12-24 | Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp… |
CVE-2025-68521 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wp… |
CVE-2025-68519 | High | 8.5 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce al… |
CVE-2025-68517 | Medium | 5.4 | 2025-12-24 | Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects T… |
CVE-2025-68516 | Medium | 5.0 | 2025-12-24 | Insertion of Sensitive Information Into Sent Data vulnerability in Essekia Tablesome tablesome allows Retrieve Embedded Sensitive Data.This issue affects Table… |
CVE-2025-68513 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows S… |
CVE-2025-68512 | Medium | 6.5 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook… |
CVE-2025-68511 | Medium | 6.5 | 2025-12-24 | Missing Authorization vulnerability in Jegstudio Gutenverse Form gutenverse-form allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-68509 | Medium | 4.7 | 2025-12-24 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Jeff Starr User Submitted Posts user-submitted-posts allows Phishing.This issue affects Us… |
CVE-2025-68508 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in Brave Brave brave-popup-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-68506 | High | 8.1 | 2025-12-24 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cach… |
CVE-2025-68505 | Medium | 5.3 | 2025-12-24 | Missing Authorization vulnerability in icc0rz H5P h5p allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects H5P: from n/a… |
CVE-2025-68500 | Medium | 4.9 | 2025-12-24 | Server-Side Request Forgery (SSRF) vulnerability in bdthemes Prime Slider – Addons For Elementor bdthemes-prime-slider-lite allows Server Side Request Forgery… |
CVE-2025-68497 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Astra Widgets astra-widgets allows Store… |
CVE-2025-68496 | High | 7.6 | 2025-12-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi User Feedback userfeedback-lite allows Blind… |
CVE-2025-68494 | Medium | 5.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor al… |
CVE-2025-68038 | High | 7.2 | 2025-12-24 | Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Exp… |
CVE-2025-67909 | High | 7.5 | 2025-12-24 | Authorization Bypass Through User-Controlled Key vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Exploiting Incorrectly… |
CVE-2025-67633 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brownbagmarketing Greenhouse Job Board greenhouse-job-boa… |
CVE-2025-67632 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design –… |
CVE-2025-67631 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecommerce Platforms Gift Hunt gift-hunt allows Stored XSS… |
CVE-2025-67630 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WH Tweaks wh-tweaks allows Stored XSS.This i… |
CVE-2025-67629 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basticom Basticom Framework basticom-framework allows Sto… |
CVE-2025-67628 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AMP-MODE Review Disclaimer review-disclaimer allows Store… |
CVE-2025-67627 | Medium | 5.9 | 2025-12-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TouchOfTech Draft Notify draft-notify allows Stored XSS.T… |
CVE-2025-67625 | Medium | 4.3 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: fr… |
CVE-2025-67623 | Medium | 5.4 | 2025-12-24 | Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage R… |
CVE-2025-67622 | High | 7.1 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in titopandub Evergreen Post Tweeter evergreen-post-tweeter allows Stored XSS.This issue affects Evergreen Post… |
CVE-2025-67621 | Medium | 4.3 | 2025-12-24 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow al… |
CVE-2025-68734 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() In hfcsusb_probe(), the memory a… | |
CVE-2025-68733 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: smack: fix bug: unprivileged task can create labels If an unprivileged task is allowed to… | |
CVE-2025-68732 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Fix race in syncpt alloc/free Fix race condition between host1x_syncpt_alloc… | |
CVE-2025-68731 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix an integer overflow in aie2_query_ctx_status_array() The unpublished s… | |
CVE-2025-68730 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Fix page fault in ivpu_bo_unbind_all_bos_from_context() Don't add BO to the v… |
CVE-2025-68729 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix MSDU buffer types handling in RX error path Currently, packets received… | |
CVE-2025-68728 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix uninit memory after failed mi_read in mi_format_new Fix a KMSAN un-init bug fo… | |
CVE-2025-68727 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: Fix uninit buffer allocated by __getname() Fix uninit errors caused after buffer a… | |
CVE-2025-68726 | Critical | 9.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: aead - Fix reqsize handling Commit afddce13ce81d ("crypto: api - Add reqsize to c… |
CVE-2025-68725 | Medium | 5.5 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Do not let BPF test infra emit invalid GSO types to stack Yinhao et al. reported tha… |
CVE-2025-68724 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id Use check_add_ov… |
CVE-2025-68380 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix peer HE MCS assignment In ath11k_wmi_send_peer_assoc_cmd(), peer's tran… | |
CVE-2025-68379 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix null deref on srq->rq.queue after resize failure A NULL pointer dereference… |
CVE-2025-68378 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stackmap overflow check in __bpf_get_stackid() Syzkaller reported a KASAN slab-o… | |
CVE-2025-68377 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: ns: initialize ns_list_node for initial namespaces Make sure that the list is always init… | |
CVE-2025-68376 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CS_MODE_SYSFS… | |
CVE-2025-68375 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: perf/x86: Fix NULL event access and potential PEBS record loss When intel_pmu_drain_pebs_… | |
CVE-2025-68374 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: md: fix rcu protection in md_wakeup_thread We attempted to use RCU to protect the pointer… | |
CVE-2025-68373 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: md: avoid repeated calls to del_gendisk There is a uaf problem which is found by case 23r… | |
CVE-2025-68372 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: nbd: defer config put in recv_work There is one uaf issue in recv_work when running NBD_C… | |
CVE-2025-68371 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race… | |
CVE-2025-68370 | High | 7.8 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: coresight: tmc: add the handle of the event to the path The handle is essential for retri… |
CVE-2025-68369 | High | 7.5 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: ntfs3: init run lock for extend inode After setting the inode mode of $Extend to a regula… |
CVE-2025-68368 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: md: init bioset in mddev_init IO operations may be needed before md_run(), such as updati… | |
CVE-2025-68367 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: macintosh/mac_hid: fix race condition in mac_hid_toggle_emumouse The following warning ap… | |
CVE-2025-68366 | | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: nbd: defer config unlock in nbd_genl_connect There is one use-after-free warning when run… | |
CVE-2025-68365 | High | 8.2 | 2025-12-24 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize allocated memory before use KMSAN reports: Multiple uninitialized va… |