Search vulnerabilities

Expected end of text, found ':' (at char 26), (line:1, col:27)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,948

CVE-2025-30808

WordPress About Author plugin <= 1.6.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weblizar - WordPress Themes & Plugin About Author about-author allows Reflected XSS.This issue affects About Author: from n/a through <= 1.6.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-30781

WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through <= 3.7.1.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-30584

WordPress AlphaOmega Captcha & Anti-Spam Filter plugin <= 3.3 - CSRF to Stored XSS Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-30536

WordPress Beautiful Link Preview plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through <= 1.5.0.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-29005

WordPress HR Management Lite plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Cross Site Request Forgery.This issue affects HR Management Lite: from n/a through <= 3.6.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-28951

WordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.This issue affects Bulk Featured Image: from n/a through <= 1.2.4.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-28867

WordPress Frontpage category filter plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue affects Frontpage category filter: from n/a through <= 1.0.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Stesvis
Products
Frontpage Category Filter
CVE-2025-28864

WordPress Builder for Contact Form 7 by Webconstruct plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through <= 1.2.2.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Planetstudio
Products
Builder For Contact Form 7
CVE-2025-27359

WordPress WP Media File Type Manager plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Media File Type Manager wp-media-file-type-manager allows Cross Site Request Forgery.This issue affects WP Media File Type Manager: from n/a through <= 2.3.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-26990

WordPress Royal Elementor Addons plugin <= 1.7.1006 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1006.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed
Vendors
Royal-elementor-addons
Products
Royal Elementor Addons
CVE-2025-26905

WordPress Estatik plugin <= 4.3.0 - Local File Inclusion vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Estatik Estatik estatik allows PHP Local File Inclusion.This issue affects Estatik: from n/a through <= 4.3.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-26898

WordPress Traveler theme < 3.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler.This issue affects Traveler: from n/a through < 3.2.1.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-24735

WordPress Chatra Live Chat + ChatBot + Cart Saver plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chatra Chatra Live Chat + ChatBot + Cart Saver allows Stored XSS. This issue affects Chatra Live Chat + ChatBot + Cart Saver: from n/a through 1.0.11.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-24689

WordPress Import and export users and customers plugin 1.27.12 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta allows Retrieve Embedded Sensitive Data.This issue affects Import and export users and customers: from n/a through <= 1.27.12.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Codection Wordpress
Products
Import And Export Users And Customers Wordpress
CVE-2025-24683

WordPress RSVP and Event Management Plugin <= 2.7.14 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Chill RSVP and Event Management rsvp allows SQL Injection.This issue affects RSVP and Event Management: from n/a through <= 2.7.14.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-24625

WordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin <= 5.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2025-23772

WordPress imaGenius Plugin <= 1.7 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eugenio Petulla’ imaGenius imagenius allows Stored XSS.This issue affects imaGenius: from n/a through <= 1.7.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-22794

WordPress World Cup Predictor Plugin <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-22629

WordPress iNET Webkit Plugin <= 1.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in iNET iNET Webkit inet-webkit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iNET Webkit: from n/a through <= 1.2.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-56236

WordPress Hestia Nginx Cache plugin <= 2.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Missing Authorization vulnerability in Juni Hestia Nginx Cache hestia-nginx-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hestia Nginx Cache: from n/a through <= 2.4.0.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—