CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- eniture small package quotes, enituretechnology small package quotes – ups edition +1 moreSmall Package Quotes – UPS Edition <= 4.5.16 - Unauthenticated SQL Injection7.5 High
- jeremyshapiro fusedeskFuseDesk <= 6.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- chuhpl book a roomBook a Room <= 2.9 - Cross-Site Request Forgery to Settings Update4.3 Medium
- eniture ltl freight quotes, enituretechnology ltl freight quotes – xpo edition +1 moreLTL Freight Quotes – XPO Edition <= 4.3.7 - Unauthenticated SQL Injection7.5 High
- cleantalk login security, firewall, malware removal by cleantalk, security \& malware scan +1 moreSecurity & Malware scan by CleanTalk <= 2.149 - Unauthenticated Arbitrary File Upload9.8 Critical
- najeebmedia easy quiz makerEasy Quiz Maker <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- infoway ebook downloaderEbook Downloader <= 1.0 - Unauthenticated SQL Injection7.5 High
- http://apusthemes.com/ wp job board pro, apusthemes superio +1 moreWP Job Board Pro < 1.2.85 - Unauthenticated Privilege Escalation via process_register9.8 Critical
- eaglethemes rise blocks – a complete gutenberg page builder, eaglevisionit rise blocks +1 moreRise Blocks – A Complete Gutenberg Page Builder <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via TitleTag Parameter6.4 Medium
- eniture ltl freight quotes, eniture technology ltl freight quotes – worldwide express edition +1 moreLTL Freight Quotes - Worldwide Express Edition <= 5.0.20 - Unauthenticated SQL Injection7.5 High
- wpcodefactory customer email verification for woocommerceCustomer Email Verification for WooCommerce <= 2.9.5 - Authentication Bypass via Shortcode7.5 High
- code-projects gym management systemCodezips Gym Management System updateroutine.php sql injection5.3 Medium
- code-projects police fir record management systemcode-projects Police FIR Record Management System Delete Record stack-based overflow4.8 Medium
- lcweb global gallery - wordpress responsive gallery, global gallery +1 moreGlobal Gallery - WordPress Responsive Gallery <= 9.1.5 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4 Medium
- smackcoders export all posts, products, orders, refunds & users, export all posts\, products\, orders\, refunds \& users +1 moreExport All Posts, Products, Orders, Refunds & Users <= 2.9.3 - Information Disclosure Through Unprotected Directory7.5 High
- dayrui xunruicmsdayrui XunRuiCMS Api.php deserialization5.3 Medium
- extra innovation inc. acmailer cgiCross-site scripting vulnerability exists in acmailer CGI ver.4.0.5 and earlier. An arbitrary...6.1 Medium
- johndarrel wp ghost (hide my wp ghost) – security & firewall, wpplugins hide my wp ghost +1 moreHide My WP Ghost – Security & Firewall <= 5.3.02 - Unauthenticated Login Page Disclosure5.3 Medium
- wpbookingcalendar booking calendarWP Booking Calendar <= 10.10 - Unauthenticated Post-Confirmation Booking Manipulation5.3 Medium
- pihome-shc pihome, pihome maxair +1 morepihome-shc PiHome ajax.php sql injection5.3 Medium
- pihome-shc pihome, pihome maxair +1 morepihome-shc PiHome ajax.php sql injection5.3 Medium
- code-projects gym management systemCodeZips Gym Management System more-userprofile.php sql injection5.3 Medium
- allimages all-images.ai – ia image bank and custom image creationAll-Images.ai – IA Image Bank and Custom Image creation <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- ahmadmj majestic support – the leading-edge help desk & customer support plugin, majesticsupport majestic support +1 moreMajestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Authenticated (Subscriber+) Insecure Direct Object Reference4.3 Medium
- ahmadmj majestic support – the leading-edge help desk & customer support plugin, majesticsupport majestic support +1 moreMajestic Support – The Leading-Edge Help Desk & Customer Support Plugin <= 1.0.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory7.5 High
- joomunited wp table managerWP Table Manager <= 4.1.3 - Missing Authorization to Authenticated (Subscriber+) Directory Traversal to Folder/File Name Disclosure4.3 Medium
- mvpthemes zoxpress, zoxpress - the all-in-one wordpress news theme +1 moreZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion8.1 High
- sktthemes admire extraAdmire Extra <= 1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpo-hr ngg smart image searchNGG Smart Image Search <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mvpthemes click mag - viral wordpress news magazine/blog theme, click mag +1 moreClick Mag - Viral WordPress News Magazine/Blog Theme <= 3.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Deletion8.1 High
- mvpthemes zoxpress, zoxpress - the all-in-one wordpress news theme +1 moreZoxPress - The All-In-One WordPress News Theme <= 2.12.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- contempoinc real estate 7 wordpress, contempothemes real estate 7 +1 moreReal Estate 7 WordPress <= 3.5.1 - Unauthenticated Privilege Escalation to Administrator9.8 Critical
- brainstorm force convertplusPopup Plugin For WordPress - ConvertPlus <= 3.5.30 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update8.1 High
- creativewerkdesigns wpsyncsheets, wpsyncsheets for wpforms – google sheets connector for wpforms & real‑time data export +1 moreWPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon <= 1.6 - Missing Authorization to Authenticated (Subscriber+) Settings Reset4.3 Medium
- gsplugins woocommerce brands, samdani gs brands for woocommerce +1 moreDiscover the Best Woocommerce Product Brands Plugin for WordPress – Woocommerce Brands Plugin <= 1.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themerex puzzles, puzzles | wp magazine / review with store wordpress theme + rtl +1 morePuzzles | WP Magazine / Review with Store WordPress Theme + RTL <= 4.2.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- adirectory, adirectory – wp business directory plugin and classified ads listings directory +1 moreaDirectory – WordPress Directory Listing Plugin <= 2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion4.3 Medium
- era404 stafflistStaffList <= 3.2.3 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- stklcode liveticker, liveticker (by stklcode) +1 moreLiveticker (by stklcode) <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- property hive houzez property feedHouzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion4.3 Medium
- vividcolorsjp aforms eatsAForms Eats <= 1.3.1 - Unauthenticated Full Path Disclosure5.3 Medium
- wpextended the ultimate wordpress toolkit – wp extended, wp extended +1 moreThe Ultimate WordPress Toolkit – WP Extended <= 3.0.13 - Missing Authorization to Unauthenticated Post Order Manipulation5.3 Medium
- dell bsafe ssl-jDell BSAFE SSL-J contains a deadlock vulnerability. A remote attacker could potentially exploit...5.9 Medium
- dell bsafe ssl-jDell BSAFE SSL-J contains an Improper certificate verification vulnerability. A remote attacker...5.9 Medium
- nvidia container toolkit, gpu operator +1 moreNVIDIA Container Toolkit for Linux contains a Time-of-Check Time-of-Use (TOCTOU) vulnerability...8.3 High
- nvidia triton inference serverNVIDIA Triton Inference Server contains a vulnerability in the model loading API, where a user...4.9 Medium
- nvidia nvjpeg2000NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a heap-based...6.8 Medium
- nvidia nvjpeg2000NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause a buffer overflow...6.8 Medium
- nvidia nvjpeg2000NVIDIA nvJPEG2000 library contains a vulnerability where an attacker can cause an out-of-bounds...6.8 Medium
- temporal technologies, inc. api-go libraryField in api-go proxy not transformed before version 1.44.12.0 Low
- Show moreLoading…