2025 CVEs (page 77)
Page 77 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12655 | Medium | 5.3 | 2025-12-12 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to arbitrary file write via a missing authorization check in all versions up to, and i… |
CVE-2025-12570 | High | 7.2 | 2025-12-12 | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 6.4.8 d… |
CVE-2025-67725 | High | 7.5 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, a single maliciously crafted HTTP request can block the ser… |
CVE-2025-67724 | Medium | 5.4 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. In versions 6.5.2 and below, the supplied reason phrase is used unescaped in HTTP header… |
CVE-2025-67508 | High | 8.4 | 2025-12-12 | gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish… |
CVE-2025-10684 | Medium | 4.3 | 2025-12-12 | The Construction Light WordPress theme before 1.6.8 does not have authorisation and CSRF when activating via an AJAX action, allowing any authenticated users… |
CVE-2025-66492 | High | 8.2 | 2025-12-12 | Masa CMS is an open source Enterprise Content Management platform. Versions 7.2.8 and below, 7.3.1 through 7.3.13, 7.4.0-alpha.1 through 7.4.8 and 7.5.0 throug… |
CVE-2025-66284 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION… |
CVE-2025-65120 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZI… |
CVE-2025-64781 | Medium | 4.7 | 2025-12-12 | In GroupSession Free edition prior to ver5.7.1, GroupSession byCloud prior to ver5.7.1, and GroupSession ZION prior to ver5.7.1, "External page display restric… |
CVE-2025-62192 | Medium | 5.4 | 2025-12-12 | SQL Injection vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5… |
CVE-2025-61987 | Medium | 5.3 | 2025-12-12 | GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION prior to ver5.3.2. do not validate origins in WebSoc… |
CVE-2025-61950 | Medium | 4.3 | 2025-12-12 | In GroupSession, a Circular notice can be created with its memo field non-editable, but the authorization check is improperly implemented. With some crafted re… |
CVE-2025-58576 | Medium | 4.3 | 2025-12-12 | Cross-site request forgery vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION p… |
CVE-2025-57883 | Medium | 6.1 | 2025-12-12 | Reflected cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZI… |
CVE-2025-54407 | Medium | 6.1 | 2025-12-12 | Stored cross-site scripting vulnerability exists in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-53523 | Medium | 5.4 | 2025-12-12 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud prior to ver5.3.3, and GroupSession ZION… |
CVE-2025-14467 | Medium | 4.4 | 2025-12-12 | The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.4. This is due to the plugin expl… |
CVE-2025-14393 | Medium | 6.4 | 2025-12-12 | The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' parameter in all versions up to, and inclu… |
CVE-2025-14392 | Medium | 4.3 | 2025-12-12 | The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the user_theme_admin, dis… |
CVE-2025-14391 | Medium | 4.3 | 2025-12-12 | The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or inco… |
CVE-2025-14354 | Medium | 4.3 | 2025-12-12 | The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is du… |
CVE-2025-14344 | Critical | 9.8 | 2025-12-12 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'plupload_aj… |
CVE-2025-14170 | Medium | 4.3 | 2025-12-12 | The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 0.2. This is due to missing authoriza… |
CVE-2025-14166 | Medium | 5.3 | 2025-12-12 | The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.0. This is due to the plugin allowing A… |
CVE-2025-14165 | Medium | 4.3 | 2025-12-12 | The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.9. This is d… |
CVE-2025-14162 | Medium | 4.3 | 2025-12-12 | The BMLT WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.11.4. This is due to missing nonce… |
CVE-2025-14161 | Medium | 4.3 | 2025-12-12 | The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce val… |
CVE-2025-14160 | Medium | 4.3 | 2025-12-12 | The Upcoming for Calendly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.4. This is due to missing… |
CVE-2025-14158 | Medium | 4.3 | 2025-12-12 | The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing nonce va… |
CVE-2025-14143 | Medium | 6.4 | 2025-12-12 | The Ayo Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' parameter of the ayo_action shortcode in all versions up t… |
CVE-2025-14138 | Medium | 6.1 | 2025-12-12 | The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14137 | Medium | 6.1 | 2025-12-12 | The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and in… |
CVE-2025-14132 | Medium | 6.1 | 2025-12-12 | The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14129 | Medium | 6.1 | 2025-12-12 | The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |
CVE-2025-14125 | Medium | 6.1 | 2025-12-12 | The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including… |
CVE-2025-14119 | Medium | 6.4 | 2025-12-12 | The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'atvc_vid… |
CVE-2025-14064 | Medium | 5.4 | 2025-12-12 | The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on multiple AJAX endpoints i… |
CVE-2025-14062 | Medium | 4.3 | 2025-12-12 | The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' parameter in all versions up to, and incl… |
CVE-2025-14048 | Medium | 4.4 | 2025-12-12 | The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option in all versions up to, and including, 1… |
CVE-2025-14045 | Medium | 4.3 | 2025-12-12 | The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability check on the url_media_uploader_url_upl… |
CVE-2025-14044 | High | 8.1 | 2025-12-12 | The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted… |
CVE-2025-14035 | Medium | 4.4 | 2025-12-12 | The DebateMaster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the color options in the plugin settings in all versions up to, and incl… |
CVE-2025-14032 | Medium | 6.4 | 2025-12-12 | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in the 'bold_timeline_group' shortcode in al… |
CVE-2025-13989 | Medium | 6.4 | 2025-12-12 | The WP Dropzone plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'callback' shortcode attribute in all versions up to, and including… |
CVE-2025-13988 | Medium | 6.1 | 2025-12-12 | The 评论小秘书 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and including, 1… |
CVE-2025-13987 | Medium | 4.3 | 2025-12-12 | The Purchase and Expense Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.2. This is due to m… |
CVE-2025-13975 | Medium | 4.4 | 2025-12-12 | The Contact Form 7 with ChatWork plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_token' and 'roomid' settings in all versions up… |
CVE-2025-13972 | Medium | 4.9 | 2025-12-12 | The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and includ… |
CVE-2025-13971 | Medium | 4.4 | 2025-12-12 | The TWW Protein Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Header' setting in all versions up to, and including, 1.0… |
CVE-2025-13969 | Medium | 6.4 | 2025-12-12 | The Reviews Sorted plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'space' parameter of the [reviews-slider] shortcode in all version… |
CVE-2025-13966 | Medium | 6.4 | 2025-12-12 | The Paypal Payment Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttom_image' parameter of the [paypal-shortcode] short… |
CVE-2025-13963 | Medium | 6.4 | 2025-12-12 | The FX Currency Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fxcc_convert' shortcode in all versions up to, an… |
CVE-2025-13962 | Medium | 6.4 | 2025-12-12 | The Divelogs Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'latestdive' shortcode in all versions up to, and includ… |
CVE-2025-13961 | Medium | 6.4 | 2025-12-12 | The Data Visualizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'visualize' shortcode in all versions up to, and includi… |
CVE-2025-13960 | Medium | 6.4 | 2025-12-12 | The GPXpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gpxpress' shortcode in all versions up to, and including, 1.3… |
CVE-2025-13906 | Medium | 6.4 | 2025-12-12 | The WP Flot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'linechart' shortcode in all versions up to, and including, 0.2… |
CVE-2025-13904 | Medium | 6.4 | 2025-12-12 | The WPGancio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'gancio-event' shortcode in all versions up to, and including… |
CVE-2025-13889 | Medium | 6.4 | 2025-12-12 | The Simple Nivo Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode parameter in all versions up to, and including… |
CVE-2025-13885 | Medium | 6.4 | 2025-12-12 | The Zenost Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' and 'target' parameters in the `button` shortcode in all… |
CVE-2025-13884 | Medium | 6.4 | 2025-12-12 | The Hide Email Address plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inline_css' parameter in the `bg-hide-email-address` shortcod… |
CVE-2025-13866 | Medium | 6.4 | 2025-12-12 | The Flow-Flow Social Feed Stream plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the flow_flow_soc… |
CVE-2025-13850 | Medium | 6.4 | 2025-12-12 | The LS Google Map Router plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'map_type' parameter in all versions up to, and including, 1… |
CVE-2025-13846 | Medium | 6.4 | 2025-12-12 | The Easy Map Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.0.2 du… |
CVE-2025-13843 | Medium | 6.4 | 2025-12-12 | The VigLink SpotLight By ShortCode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'float' parameter of the 'spotlight' shortcode in… |
CVE-2025-13840 | Medium | 6.4 | 2025-12-12 | The BUKAZU Search widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode' parameter of the 'bukazu_search' shortcode in al… |
CVE-2025-13747 | Medium | 6.4 | 2025-12-12 | The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a regex bypass in nsp_shortcode function in all versions up to, and incl… |
CVE-2025-13440 | Medium | 5.3 | 2025-12-12 | The Premmerce Wishlist for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.1.10. This is due to… |
CVE-2025-13408 | Medium | 4.3 | 2025-12-12 | The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versio… |
CVE-2025-13366 | Medium | 4.3 | 2025-12-12 | The Rabbit Hole plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or incorrect… |
CVE-2025-13363 | Medium | 4.3 | 2025-12-12 | The IMAQ Core plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing nonce valida… |
CVE-2025-13334 | High | 8.1 | 2025-12-12 | The Blaze Demo Importer plugin for WordPress is vulnerable to unauthorized database resets and file deletion due to a missing capability check on the "blaze_de… |
CVE-2025-13320 | Medium | 6.8 | 2025-12-12 | The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient val… |
CVE-2025-13314 | Medium | 5.3 | 2025-12-12 | The Product Filtering by Categories, Tags, Price Range for WooCommerce – Filter Plus plugin for WordPress is vulnerable to unauthorized modification of data in… |
CVE-2025-12968 | High | 8.8 | 2025-12-12 | The Infility Global plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation and capability checks in all versions up t… |
CVE-2025-12963 | Critical | 9.8 | 2025-12-12 | The LazyTasks – Project & Task Management with Collaboration, Kanban and Gantt Chart plugin for WordPress is vulnerable to privilege escalation via account tak… |
CVE-2025-12883 | Medium | 5.3 | 2025-12-12 | The Campay Woocommerce Payment Gateway plugin for WordPress is vulnerable to Unauthenticated Payment Bypass in all versions up to, and including, 1.2.2. This i… |
CVE-2025-12834 | Medium | 6.1 | 2025-12-12 | The Accept Stripe Payments Using Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'failure_message' parameter in ver… |
CVE-2025-12830 | Medium | 6.4 | 2025-12-12 | The Better Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Slider widget in all versions up to, and including, 1.5.5… |
CVE-2025-12824 | High | 8.8 | 2025-12-12 | The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shor… |
CVE-2025-12783 | Medium | 4.3 | 2025-12-12 | The Premmerce Brands for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveBrand… |
CVE-2025-12650 | Medium | 6.4 | 2025-12-12 | The Simple post listing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'class_name' parameter in the postlist shortcode in all versi… |
CVE-2025-13886 | High | 7.5 | 2025-12-12 | The LT Unleashed plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1.1 via the 'template' parameter in the `bo… |
CVE-2025-13839 | Medium | 6.4 | 2025-12-12 | The LJUsers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter of the 'ljuser' shortcode in all versions up to, and inc… |
CVE-2025-13670 | Medium | 6.7 | 2025-12-12 | The High Level Synthesis Compiler i++ command for Windows is vulnerable to a DLL planting vulnerability |
CVE-2025-13669 | Medium | 6.7 | 2025-12-12 | Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level S… |
CVE-2025-13665 | Medium | 6.7 | 2025-12-12 | The System Console Utility for Windows is vulnerable to a DLL planting vulnerability |
CVE-2025-13053 | Low | 3.7 | 2025-12-12 | When a user configures the NAS to retrieve UPS status or control the UPS, a non-enforced TLS certificate verification can allow an attacker able to intercept n… |
CVE-2025-13052 | Medium | 5.9 | 2025-12-12 | When the user set the Notification's sender to send emails to the SMTP server via msmtp, an improper validated TLS/SSL certificates allows an attacker who can… |
CVE-2025-10451 | High | 8.2 | 2025-12-12 | Unchecked output buffer may allowed arbitrary code execution in SMM and potentially result in SMM memory corruption. |
CVE-2025-67779 | High | 7.5 | 2025-12-12 | It was found that the fix addressing CVE-2025-55184 in React Server Components was incomplete and does not prevent a denial of service attack in a specific cas… |
CVE-2025-67780 | Medium | 4.2 | 2025-12-11 | SpaceX Starlink Dish devices with firmware 2024.12.04.mr46620 (e.g., on Mini1_prod2) allow administrative actions via unauthenticated LAN gRPC requests, aka MA… |
CVE-2025-66452 | Medium | 6.1 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, there is no handler for JSON parsing errors; SyntaxError from express.json(… |
CVE-2025-66451 | Medium | 6.5 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when creating prompts, JSON requests are sent to define and modify the prom… |
CVE-2025-66450 | Medium | 5.4 | 2025-12-11 | LibreChat is a ChatGPT clone with additional features. In versions 0.8.0 and below, when a user posts a question, the iconURL parameter of the POST request can… |
CVE-2025-66446 | High | 8.8 | 2025-12-11 | MaxKB is an open-source AI assistant for enterprise. Versions 2.3.1 and below have improper file permissions which allow attackers to overwrite the built-in dy… |
CVE-2025-66419 | High | 8.8 | 2025-12-11 | MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox environment and esca… |
CVE-2025-64721 | Critical | 10.0 | 2025-12-11 | Sandboxie is a sandbox-based isolation software for 32-bit and 64-bit Windows NT-based operating systems. In versions 1.16.6 and below, the SYSTEM-level servic… |
CVE-2025-34506 | High | 8.8 | 2025-12-11 | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload malicious modules. Attacker… |
CVE-2025-34504 | Medium | 6.1 | 2025-12-11 | KodExplorer 4.52 contains an open redirect vulnerability in the user login page that allows attackers to manipulate the 'link' parameter. Attackers can craft m… |