2025 CVEs (page 75)
Page 75 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13506 | High | 8.8 | 2025-12-12 | Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating… |
CVE-2025-14442 | Medium | 5.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV file… |
CVE-2025-14159 | Medium | 4.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4… |
CVE-2025-14065 | Medium | 4.3 | 2025-12-12 | The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni… |
CVE-2025-14030 | Medium | 6.4 | 2025-12-12 | The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22… |
CVE-2025-12965 | Medium | 6.4 | 2025-12-12 | The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion w… |
CVE-2025-12408 | Medium | 5.3 | 2025-12-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7… |
CVE-2025-12407 | Medium | 4.3 | 2025-12-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2025-12841 | Medium | 5.3 | 2025-12-12 | The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options. |
CVE-2025-12835 | High | 7.3 | 2025-12-12 | The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber… |
CVE-2025-58137 | High | 8.1 | 2025-12-12 | Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in v… |
CVE-2025-58130 | Critical | 9.1 | 2025-12-12 | Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12… |
CVE-2025-26866 | High | 8.8 | 2025-12-12 | A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-… |
CVE-2025-23408 | Medium | 6.5 | 2025-12-12 | Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users… |
CVE-2025-14074 | Medium | 4.3 | 2025-12-12 | The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability che… |
CVE-2025-13993 | Medium | 5.5 | 2025-12-12 | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' par… |
CVE-2025-12348 | Medium | 5.3 | 2025-12-12 | The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, an… |
CVE-2025-40829 | High | 7.8 | 2025-12-12 | A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while p… |
CVE-2025-12960 | Medium | 6.5 | 2025-12-12 | The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[cs… |
CVE-2025-67731 | High | 7.5 | 2025-12-12 | Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without… |
CVE-2025-67730 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to ad… |
CVE-2025-4970 | Medium | 5.5 | 2025-12-12 | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to i… |
CVE-2025-14169 | High | 7.5 | 2025-12-12 | The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all ve… |
CVE-2025-14049 | Medium | 6.1 | 2025-12-12 | The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versio… |
CVE-2025-13891 | Medium | 6.5 | 2025-12-12 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due t… |
CVE-2025-11876 | Medium | 6.4 | 2025-12-12 | The Mailgun Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mailgun_subscription_form' shortcode in all versi… |
CVE-2025-10583 | Low | 3.5 | 2025-12-12 | The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_… |
CVE-2025-67737 | Low | 3.1 | 2025-12-12 | AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the… |
CVE-2025-67728 | Critical | 9.8 | 2025-12-12 | Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads… |
CVE-2025-67727 | Critical | 9.8 | 2025-12-12 | Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow i… |
CVE-2025-67726 | High | 7.5 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP h… |
CVE-2025-14356 | Medium | 4.3 | 2025-12-12 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_gener… |
CVE-2025-14068 | High | 7.5 | 2025-12-12 | The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 0.6.3 due to ins… |
CVE-2025-13660 | Medium | 5.3 | 2025-12-12 | The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a pub… |
CVE-2025-12655 | Medium | 5.3 | 2025-12-12 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and i… |
CVE-2025-12570 | High | 7.2 | 2025-12-12 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 d… |
CVE-2025-67725 | High | 7.5 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the ser… |
CVE-2025-67724 | Medium | 5.4 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP header… |
CVE-2025-67508 | High | 8.4 | 2025-12-12 | gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish… |
CVE-2025-10684 | Medium | 4.3 | 2025-12-12 | The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users… |
CVE-2025-66492 | High | 8.2 | 2025-12-12 | Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 throug… |
CVE-2025-66284 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION… |
CVE-2025-65120 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZI… |
CVE-2025-64781 | Medium | 4.7 | 2025-12-12 | In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restric… |
CVE-2025-62192 | Medium | 5.4 | 2025-12-12 | SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5… |
CVE-2025-61987 | Medium | 5.3 | 2025-12-12 | GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not validate origins in WebSoc… |
CVE-2025-61950 | Medium | 4.3 | 2025-12-12 | In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted re… |
CVE-2025-58576 | Medium | 4.3 | 2025-12-12 | Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION p… |
CVE-2025-57883 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZI… |
CVE-2025-54407 | Medium | 6.1 | 2025-12-12 | Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-53523 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-14467 | Medium | 4.4 | 2025-12-12 | The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin expl… |
CVE-2025-14393 | Medium | 6.4 | 2025-12-12 | The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' parameter in all versions up to, and inclu… |
CVE-2025-14392 | Medium | 4.3 | 2025-12-12 | The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, dis… |
CVE-2025-14391 | Medium | 4.3 | 2025-12-12 | The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or inco… |
CVE-2025-14354 | Medium | 4.3 | 2025-12-12 | The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is du… |
CVE-2025-14344 | Critical | 9.8 | 2025-12-12 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_aj… |
CVE-2025-14170 | Medium | 4.3 | 2025-12-12 | The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authoriza… |
CVE-2025-14166 | Medium | 5.3 | 2025-12-12 | The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing A… |
CVE-2025-14165 | Medium | 4.3 | 2025-12-12 | The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is d… |
CVE-2025-14162 | Medium | 4.3 | 2025-12-12 | The BMLT WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.11.4. This is due to missing nonce… |
CVE-2025-14161 | Medium | 4.3 | 2025-12-12 | The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce val… |
CVE-2025-14160 | Medium | 4.3 | 2025-12-12 | The Upcoming for Calendly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing… |
CVE-2025-14158 | Medium | 4.3 | 2025-12-12 | The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce va… |
CVE-2025-14143 | Medium | 6.4 | 2025-12-12 | The Ayo Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' parameter of the ayo_action shortcode in all versions up t… |
CVE-2025-14138 | Medium | 6.1 | 2025-12-12 | The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14137 | Medium | 6.1 | 2025-12-12 | The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and in… |
CVE-2025-14132 | Medium | 6.1 | 2025-12-12 | The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14129 | Medium | 6.1 | 2025-12-12 | The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-14125 | Medium | 6.1 | 2025-12-12 | The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including… |
CVE-2025-14119 | Medium | 6.4 | 2025-12-12 | The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_vid… |
CVE-2025-14064 | Medium | 5.4 | 2025-12-12 | The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints i… |
CVE-2025-14062 | Medium | 4.3 | 2025-12-12 | The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and incl… |
CVE-2025-14048 | Medium | 4.4 | 2025-12-12 | The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option in all versions up to, and including, 1… |
CVE-2025-14045 | Medium | 4.3 | 2025-12-12 | The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upl… |
CVE-2025-14044 | High | 8.1 | 2025-12-12 | The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted… |
CVE-2025-14035 | Medium | 4.4 | 2025-12-12 | The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and incl… |
CVE-2025-14032 | Medium | 6.4 | 2025-12-12 | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in al… |
CVE-2025-13989 | Medium | 6.4 | 2025-12-12 | The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including… |
CVE-2025-13988 | Medium | 6.1 | 2025-12-12 | The 评论小秘书 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1… |
CVE-2025-13987 | Medium | 4.3 | 2025-12-12 | The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to m… |
CVE-2025-13975 | Medium | 4.4 | 2025-12-12 | The Contact Form 7 with ChatWork plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_token' and 'roomid' settings in all versions up… |
CVE-2025-13972 | Medium | 4.9 | 2025-12-12 | The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and includ… |
CVE-2025-13971 | Medium | 4.4 | 2025-12-12 | The TWW Protein Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Header' setting in all versions up to, and including, 1.0… |
CVE-2025-13969 | Medium | 6.4 | 2025-12-12 | The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all version… |
CVE-2025-13966 | Medium | 6.4 | 2025-12-12 | The Paypal Payment Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttom_image' parameter of the [paypal-shortcode] short… |
CVE-2025-13963 | Medium | 6.4 | 2025-12-12 | The FX Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fxcc_convert' shortcode in all versions up to, an… |
CVE-2025-13962 | Medium | 6.4 | 2025-12-12 | The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and includ… |
CVE-2025-13961 | Medium | 6.4 | 2025-12-12 | The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions up to, and includi… |
CVE-2025-13960 | Medium | 6.4 | 2025-12-12 | The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, and including, 1.3… |
CVE-2025-13906 | Medium | 6.4 | 2025-12-12 | The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, and including, 0.2… |
CVE-2025-13904 | Medium | 6.4 | 2025-12-12 | The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including… |
CVE-2025-13889 | Medium | 6.4 | 2025-12-12 | The Simple Nivo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode parameter in all versions up to, and including… |
CVE-2025-13885 | Medium | 6.4 | 2025-12-12 | The Zenost Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'target' parameters in the `button` shortcode in all… |
CVE-2025-13884 | Medium | 6.4 | 2025-12-12 | The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the `bg-hide-email-address` shortcod… |
CVE-2025-13866 | Medium | 6.4 | 2025-12-12 | The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_soc… |
CVE-2025-13850 | Medium | 6.4 | 2025-12-12 | The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up to, and including, 1… |
CVE-2025-13846 | Medium | 6.4 | 2025-12-12 | The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.0.2 du… |
CVE-2025-13843 | Medium | 6.4 | 2025-12-12 | The VigLink SpotLight By ShortCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'float' parameter of the 'spotlight' shortcode in… |
CVE-2025-13840 | Medium | 6.4 | 2025-12-12 | The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in al… |