CVE-2022-44588

WordPress Cryptocurrency Widgets Pack Plugin <=1.8.1 is vulnerable to SQL Injection

Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress.

CVSS 3.1 · 9.9 Critical EPSS 2.4% KEV · Not listed

Vendors

Blocksera

Products

Cryptocurrency Widgets Pack

CVE-2022-44578

WordPress Owl Carousel plugin <= 0.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Pierre JEHAN Owl Carousel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Owl Carousel: from n/a through 0.5.3.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Pierre-jehan Wordpress

Products

Owl Carousel Wordpress

CVE-2022-43472

WordPress eRoom plugin <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in StylemixThemes eRoom – Zoom Meetings & Webinar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects eRoom – Zoom Meetings & Webinar: from n/a through 1.4.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2022-42882

WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Shambix Simple CSV/XLS Exporter.This issue affects Simple CSV/XLS Exporter: from n/a through 1.5.8.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Shambix

Products

Simple Csv\/xls Exporter

CVE-2022-41650

WordPress Custom Content by Country plugin <= 3.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Paul Custom Content by Country (by Shield Security) custom-content-by-country.This issue affects Custom Content by Country (by Shield Security): from n/a through 3.1.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Paul Wordpress

Products

Custom Content By Country (by Shield Security) Wordpress

CVE-2022-41616

WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Kaushik Kalathiya Export Users Data CSV.This issue affects Export Users Data CSV: from n/a through 2.1.

CVSS 3.1 · 7.6 High EPSS 1.0% KEV · Not listed

Vendors

Kaushikkalathiya

Products

Export Users Data

CVE-2022-40219

WordPress FavIcon Switcher plugin <= 1.2.11 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in SedLex FavIcon Switcher plugin <= 1.2.11 at WordPress allows plugin settings change.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sedlex

Products

Favicon-switcher

CVE-2022-40211

WordPress GiveWP plugin <= 2.25.1 - Cross Site Scripting (XSS) via render_dropdown vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from n/a through 2.25.1.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Givewp

Products

Givewp

CVE-2022-38702

WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV Injection

Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Kigurumi

Products

Csv Exporter

CVE-2025-24153

Kernel Buffer Overflow Enables Root-Privileged Code Execution in macOS

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3. An app with root privileges may be able to execute arbitrary code with kernel privileges.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24115

Sandbox Path Traversal Allowing Unauthorized File Access

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to read files outside of its sandbox.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24103

Symlink Validation Vulnerability Enabling Access to Protected User Data

This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to access protected user data.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24257

Apple OS Out-of-Bounds Write Allowing Kernel Memory Corruption

An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS 11.4. An app may be able to cause unexpected system termination or write kernel memory.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 1 more

CVE-2025-24240

Race Condition Allows Unauthorized Access to User‑Sensitive Data

A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to access user-sensitive data.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-30429

Path Handling Vulnerability Allowing Sandbox Escape in Apple Operating Systems

A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. An app may be able to break out of its sandbox.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Ipados Iphone Os Macos and 2 more

CVE-2025-30444

Malicious SMB Share Causes System Termination via Race Condition in macOS

A race condition was addressed with improved locking. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. Mounting a maliciously crafted SMB network share may lead to system termination.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24276

macOS Private Information Disclosure via Vulnerable Code

This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able to access private information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24247

macOS Type Confusion Vulnerability Allowing Unexpected Application Termination

A type confusion issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An attacker may be able to cause unexpected app termination.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Macos

CVE-2025-24226

Information Disclosure in Xcode via Malicious App

The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple

Products

Xcode

CVE-2025-24231

Vulnerability Allowing Modification of Protected File System on macOS

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modify protected parts of the file system.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed

Vendors

Apple

Products

Macos