CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- merkur software b2b login panelSQLi in Merkur Software's B2B Login Panel9.8 Critical
- boceksoft informatics e-travelSQLi in Boceksoft Informatics' E-Travel9.8 Critical
- pik online yazılım çözümleri a.ş. online, pozitifik pik online +1 moreBroken Access Control in PozitifIK's Pik Online7.6 High
ringcrates.ioVersions of *ring* prior to 0.17 are unmaintained.No score- wago cc100 0751-9x01, edge controller 0752-8303/8000-0002, pfc100 g1 0750-810x/xxxx-xxxx +9 more +11 moreWago: Vulnerability in libwagosnmp5.4 Medium
- fave themes homey login registerHomey Login Register <= 2.4.0 - Unauthenticated Privilege Escalation in homey_register9.8 Critical
- codeatlantic content control – the ultimate content restriction plugin! restrict content, create conditional blocks & moreContent Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More <= 2.5.0 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.10.0 - Unauthenticated SQL Injection via search Parameter7.5 High
- silkalns sparklingSparkling <= 2.4.9 - Missing Authorization to Unauthenticated Arbitrary Plugin Activation/Deactivation5.3 Medium
- fave themes homeyHomey <= 2.4.2 - Unauthenticated Privilege Escalation in homey_save_profile9.8 Critical
- designthemes core featuresDesignThemes Core Features <= 4.7 - Missing Authorization to Unauthenticated Arbitrary File Read via dt_process_imported_file7.5 High
- javmah wpgsi: spreadsheet integrationSpreadsheet Integration <= 3.8.2 - Cross-Site Request Forgery to Arbitrary Post Publish4.3 Medium
- elastic kibanaKibana arbitrary code execution via prototype pollution9.9 Critical
- cidcode woomail - woocommerce email customizerWooMail - WooCommerce Email Customizer <= 3.0.34 - Authenticated (Subscriber+) Missing Authorization to SQL Injection4.3 Medium
- ddeveloper wordpress awesome import & export plugin - import & export wordpress dataWordPress Awesome Import & Export Plugin - Import & Export WordPress Data <= 4.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary SQL Execution/Privilege Escalation8.8 High
- averta master slider – responsive touch slider, master slider +1 moreMaster Slider – Responsive Touch Slider <= 3.10.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_slider Shortcode6.4 Medium
- themographics listingoListingo - Business Listing and Directory WordPress Theme <= 3.2.7 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- althemist zass - woocommerce theme for handmade artists and artisansZass - WooCommerce Theme for Handmade Artists and Artisans <= 3.9.9.10 - Missing Authorization to Authenticated (Subscriber+) Demo Import4.3 Medium
- designthemes veda - multipurpose wordpress themeVEDA - MultiPurpose WordPress Theme <= 4.2 - Authenticated (Subscriber+) PHP Object Injection9.8 Critical
- heroplugins hero slider - wordpress slider pluginHero Slider - WordPress Slider Plugin <= 1.3.5 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- zipang point makerPoint Maker <= 0.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- chimpstudio wp real estate managerWP Real Estate Manager <= 2.8 - Authentication Bypass via Account Takeover9.8 Critical
- futuredesigngrp wp online contractWP Online Contract <= 5.1.4 - Missing Authorization to Unauthenticated Settings Import6.5 Medium
- richardgabriel staff directory plugin: company directoryCompany Directory <= 4.3 - Reflected Cross-Site Scripting via add_query_arg Function6.1 Medium
- cipherdevgroup wp featherlight – a simple jquery lightbox, dfactory responsive lightbox & gallery +1 moreMultiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Featherlight.js JavaScript Library6.4 Medium
- althemist lafka - multi store burger - pizza & food delivery woocommerce themeLafka - Multi Store Burger - Pizza & Food Delivery WooCommerce Theme <= 4.5.7 - Missing Authorization to Authenticated (Subscriber+) Demo Import4.3 Medium
- heroplugins hero mega menu - responsive wordpress menu pluginHero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Authenticated (Subscriber+) SQL Injection6.5 Medium
- averta master slider – responsive touch slider, master slider +1 moreMaster Slider – Responsive Touch Slider <= 3.10.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via ms_layer Shortcode6.4 Medium
- heroplugins hero mega menu - responsive wordpress menu pluginHero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Directory Deletion6.5 Medium
- heroplugins hero mega menu - responsive wordpress menu pluginHero Mega Menu - Responsive WordPress Menu Plugin <= 1.16.5 - Reflected Cross-Site Scripting6.1 Medium
- digitalzoomstudio zoomsounds, zoomit zoomsounds - wordpress wave audio player with playlist +1 moreZoomSounds - WordPress Wave Audio Player with Playlist <= 6.91 - Unauthenticated PHP Object Injection8.1 High
- fantasticplugins woocommerce recover abandoned cartWooCommerce Recover Abandoned Cart <= 24.4.0 - Unauthenticated PHP Object Injection8.1 High
- eaton foreseer reporting software (frs)Improper cookie attributes in Foreseer Reporting Software (FRS)5.6 Medium
- appsbd simple notificationSimple Notification <= 1.3 - Authenticated (Administrator+) Stored Cross-Site Scripting6.4 Medium
- worldweb recently purchased products for wooRecently Purchased Products For Woo <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via view Parameter6.4 Medium
- razorpay subscription button elementor pluginRazorpay Subscription Button Elementor Plugin <= 1.0.3 - Reflected Cross-Site Scripting via add_query_arg and remove_query_arg Functions6.1 Medium
- https://themeforest.net/item/jnews-one-stop-solution-for-web-publishing/20566392 jnews - wordpress newspaper magazine blog amp themeJNews - WordPress Newspaper Magazine Blog AMP Theme <= 11.6.6 - Unauthorized User Registration5.3 Medium
- searchiq, searchiq – the search solution +1 moreSearchIQ – The Search Solution <= 4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- johnjamesjacoby bbpressbbPress <= 2.6.11 - Cross-Site Request Forgery to Limited Privilege Escalation6.3 Medium
- webtroniclabs i am gloriaI Am Gloria <= 1.1.4 - Cross-Site Request Forgery4.3 Medium
- weidmueller procon-winWeidmueller: Authentication Vulnerability due to Hard-coded Credentials9.8 Critical
- google chromeInappropriate implementation in Permission Prompts in Google Chrome prior to 134.0.6998.35...4.3 Medium
- google chromeInappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35...4.3 Medium
- google chromeInappropriate implementation in Media Stream in Google Chrome prior to 134.0.6998.35 allowed a...6.5 Medium
- google chromeOut of bounds read in Media in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to...8.8 High
- google chromeOut of bounds read in PDFium in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to...8.8 High
- google chromeInappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35...4.3 Medium
- google chromeUse after free in Profiles in Google Chrome prior to 134.0.6998.35 allowed an attacker who...8.8 High
- google chromeImproper Limitation of a Pathname to a Restricted Directory in DevTools in Google Chrome on...8.1 High
- google chromeOut of bounds read in V8 in Google Chrome prior to 134.0.6998.35 allowed a remote attacker to...8.8 High
- Show moreLoading…