CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- ajitae google plusWordPress Google Plus Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ntm custom-field-list-widgetWordPress Custom Field List Widget Plugin <= 1.5.1 - Local File Inclusion vulnerability8.1 High
- alex furr linkedin liteWordPress LinkedIn Lite Plugin <= 1.0 - Local File Inclusion vulnerability8.1 High
- cosmin schiopu infugratorWordPress Infugrator plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- atelierhyper aumenuWordPress AuMenu plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound appreviewWordPress AppReview plugin <= 0.2.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- reuven karasik your lightboxWordPress Your Lightbox plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- narnoo operator, notfound narnoo operator +1 moreWordPress Narnoo Operator plugin <= 2.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- cxc-sawa management-screen-droptilesWordPress Management-screen-droptiles plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound frontend post submissionWordPress Frontend Post Submission plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- khanhtruong wp database auditWordPress WP Database Audit plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rhizome networks cg buttonWordPress CG Button plugin <= 1.0.5.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound pixobe cartography, pixobe cartography +1 moreWordPress Pixobe Cartography plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound rdp ingroups+WordPress RDP inGroups+ plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- fomopay fomo pay chinese payment solutionWordPress FOMO Pay Chinese Payment Solution plugin <= 2.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- robert d payne rdp linkedin loginWordPress RDP Linkedin Login plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpsiteeditor site editor google mapWordPress Site Editor Google Map plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound rws enquiry and lead follow-upWordPress RWS Enquiry And Lead Follow-up plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound ns simple intro loaderWordPress NS Simple Intro Loader plugin <= 2.2.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- riyaz getsocialWordPress GetSocial Plugin <= 2.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- discourseDiscourse may bypass user preference when adding users to chat groups4.3 Medium
@mozilla/readabilitynpm@mozilla/readability Denial of Service through Regex2.9 Low- discourseDiscourse has race condition when adding users to a group DM4.3 Medium
- ibm cognos controller, controller +1 moreIBM Cognos Controller HTTP response smuggling4.7 Medium
- icinga icingaweb2-module-directorIcinga has rest API endpoints accessible to restricted users5.5 Medium
- xiaomi game center applicationGame center application has code execution Vulnerability7.8 High
- cyberchimps responsive addons for elementor, responsive addons for elementor – free elementor addons, kits and elementor templates +1 moreResponsive Addons for Elementor – Free Elementor Addons Plugin and Elementor Templates <= 1.6.8 - Authenticated (Contributor+) Sensitive Information Exposure5.7 Medium
xmas-elfcrates.ioxmas-elf potential out-of-bounds read with a malformed ELF file and the HashTable API.6.9 Medium- webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 moreProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter7.2 High
- webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 moreProduct Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Deletion via admin_log_page Function2.7 Low
- webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 moreProduct Import Export for WooCommerce <= 2.5.0 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function7.6 High
- ultimateblocks ultimate blocks – 25+ gutenberg blocks for block editorUltimate Blocks – WordPress Blocks Plugin <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- zapier for wordpressZapier for WordPress <= 1.5.1 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via updated_user Function6.4 Medium
- webtoffee product import export for woocommerce – import export product csv suite, product import export for woocommerce +1 moreProduct Import Export for WooCommerce <= 2.5.0 - Directory Traversal to Authenticated (Administrator+) Limited Arbitrary File Read via download_file Function4.9 Medium
- wordpressdotorg wordpress importerWordPress Importer <= 0.8.3 - Authenticated (Administrator+) PHP Object Injection7.2 High
- aresit wp compress – instant performance & speed optimization, wpcompress wp compress +1 moreWP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions8.8 High
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Crypt/Eksblowfish/Bcrypt.pm4.0 Medium
- wreis dbix::class::encodedcolumnDBIx::Class::EncodedColumn until 0.00032 for Perl uses insecure rand() function for salting password hashes in Digest.pm4.0 Medium
- infonet projekt sa oxari servicedeskImproper permission control in OXARI ServiceDesk9.3 Critical
- checkmkSession logout can be overwritten by long lasting request2.3 Low
- mdempfle advanced iframeAdvanced iFrame <= 2024.5 - Unauthenticated Settings Update5.3 Medium
- ultimateblocks ultimate blocks – 25+ gutenberg blocks for block editorUltimate Blocks <= 3.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via content Parameter6.4 Medium
- mdempfle advanced iframeAdvanced iFrame <= 2024.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Host Header6.4 Medium
- mdempfle advanced iframeAdvanced iFrame <= 2025.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- blueglassch job postingsJobs for WordPress <= 2.7.11 - Authenticated (Subscriber+) Arbitrary File Read6.5 Medium
- vcita crm and lead management by vcitaCRM and Lead Management by vcita <= 2.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- realmag777 active products tables for woocommerce. use constructor to create tablesActive Products Tables for WooCommerce <= 1.0.6.7 - Unauthenticated Arbitrary Filter Call7.3 High
- xenioushk bwl advanced faq managerBWL Advanced FAQ Manager <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Options Update8.1 High
- bastho event postEvent post <= 5.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- contrid newslettersNewsletters <= 4.9.9.7 - Unauthenticated Stored Cross-Site Scripting7.2 High
- Show moreLoading…