CVEs published in February 2025
3,569 vulnerabilities, 260 critical, 15 exploited.
- jürgen müller easy quotesWordPress Easy Quotes plugin <= 1.2.2 - SQL Injection vulnerability9.3 Critical
- bplugins counters blockWordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins countdown timerWordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins icon list blockWordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpjobportal wp job portalWordPress WP Job Portal plugin <= 2.2.8 - Local File Inclusion vulnerability7.5 High
- quantumcloud chatbotWordPress WPBot plugin <= 6.3.5 - Local File Inclusion vulnerability7.5 High
- tribulant software gallery votingWordPress Tribulant Gallery Voting plugin <= 1.2.1 - CSRF to Stored XSS vulnerability7.1 High
- xfinitysoft order limit for woocommerceWordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability4.3 Medium
- bookneticWordPress Booknetic plugin < 5.10.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- pickplugins wishlistWordPress Wishlist Plugin <= 1.0.41 - SQL Injection vulnerability8.5 High
- webandprint ar for wordpressWordPress AR for WordPress plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hashthemes easy elementor addonsWordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bowo system dashboardWordPress System Dashboard plugin <= 2.8.18 - Sensitive Data Exposure vulnerability4.3 Medium
- estatik mortgage calculator estatikWordPress Estatik Mortgage Calculator plugin <= 2.0.12 - Local File Inclusion vulnerability7.5 High
- estatikWordPress Estatik plugin <= 4.3.0 - Local File Inclusion vulnerability7.5 High
- gal op wp responsive auto fit textWordPress WP Responsive Auto Fit Text plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- flexmls flexmls® idxWordPress Flexmls® IDX Plugin Plugin <= 3.14.27 - PHP Object Injection vulnerability9.8 Critical
- baden list related attachmentsWordPress List Related Attachments plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- vpiwigo piwigopressWordPress PiwigoPress plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kiran potphode easy chartsWordPress Easy Charts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- vw themes ibtanaWordPress Ibtana plugin <= 1.2.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- eli ez sql reports shortcode widget and db backupWordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.21.35 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpsoul greenshift, greenshiftwp greenshift - animation and page builder blocks +1 moreWordPress Greenshift plugin <= 10.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ghozylab popup builderWordPress Popup Builder plugin <= 1.1.33 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bplugins sticky contentWordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- patternsinthecloud autoship cloud for woocommerce subscription productsWordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- etoilewebdesign front end usersWordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codemanas search with typesenseWordPress Search with Typesense Plugin <= 2.0.8 - Path Traversal vulnerability6.8 Medium
- wpdeveloper essential blocks for gutenberg, essential blocks +1 moreWordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerability4.3 Medium
- fastflow fast flowWordPress Fast Flow plugin <= 1.2.16 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- videowhisper broadcast live videoWordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Download vulnerability7.5 High
- videowhisper broadcast live videoWordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Deletion vulnerability8.6 High
- fahad mahmood alphabetic paginationWordPress Alphabetic Pagination Plugin <= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- elementor website builderWordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- george pattichis simple photo feedWordPress Simple Photo Feed Plugin <= 1.4.0 - Broken Access Control vulnerability5.4 Medium
- dynamiapps frontend admin, shabti frontend admin by dynamiapps +1 moreWordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- majestic support supportWordPress Majestic Support plugin <= 1.0.6 - Local File Inclusion vulnerability8.1 High
- dell secure connect gateway, secure connect gateway - appliance, secure connect gateway - application +2 moreThe Dell Secure Connect Gateway (SCG) Application and Appliance, versions prior to 5.28, contains...2.3 Low
- webfactory advanced google recaptchaAdvanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass5.3 Medium
- hzmanyun education and training systemhzmanyun Education and Training System pdf2swf os command injection5.3 Medium
- kriesi enfold, enfold - responsive multi-purpose theme +1 moreEnfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id6.4 Medium
- kriesi enfold, enfold - responsive multi-purpose theme +1 moreEnfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php5.3 Medium
- iptanus wordpress file upload, nickboss iptanus file upload +1 moreWordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details4.3 Medium
- zephyrproject zephyrOut of bounds read in dns_copy_qname8.2 High
- zephyrproject zephyrOut of bounds read when unpacking DNS answers8.2 High
- zephyrproject zephyrOut of bounds read when calling crc16_ansi and strlen in dns_validate_msg8.2 High
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletion9.8 Critical
- radiustheme classified listing, techlabpro1 classified listing – ai-powered classified ads & business directory plugin +1 moreClassified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings Exposure5.3 Medium
- yawaveYawave <= 2.9.1 - Unauthenticated SQL Injection7.5 High
- imagely nextgen gallery, unknown photo gallery, sliders, proofing and themes +1 moreNextGEN Gallery < 3.59.9 - Admin+ Stored XSS3.5 Low
- Show moreLoading…