CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- eli ez sql reports shortcode widget and db backupWordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.25.08 - CSRF to Stored XSS vulnerability7.1 High
- oooorgle quotes llamaWordPress Quotes llama plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- wp shuffle subscribe to download liteWordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion Vulnerability7.5 High
- wp shuffle subscription formsWordPress WP Subscription Forms plugin <= 1.2.3 - SQL Injection Vulnerability8.5 High
- jgwhite33 wp google review sliderWordPress WP Google Review Slider plugin <= 16.0 - CSRF to SQL Injection vulnerability8.2 High
- wpfactory scheduled & automatic order status controller for woocommerceWordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection Vulnerability4.7 Medium
- cubecolour audio albumWordPress Audio Album plugin <= 1.5.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- nick doneren met mollieWordPress Doneren met Mollie plugin <= 2.10.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- devitems support genixWordPress Support Genix plugin <= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability4.3 Medium
- webvitaly sitekitWordPress Sitekit plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- amentotech private limited wpguppyWordPress WPGuppy plugin <= 1.1.3 - SQL Injection vulnerability8.5 High
- cozmoslabs translatepressWordPress TranslatePress plugin <= 2.9.6 - PHP Object Injection Vulnerability7.2 High
- alain-aymerick francois wp cassifyWordPress WP Cassify plugin <= 2.3.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- syed balkhi charitableWordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- alexvtn wip woocarousel liteWordPress WIP WooCarousel Lite plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- wpclever wpc smart upsell funnel for woocommerceWordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability8.8 High
- mlaza jalbum bridgeWordPress jAlbum Bridge plugin <= 2.0.18 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- add-ons.org pdf for wpformsWordPress PDF for WPForms plugin <= 5.3.0 - Arbitrary Shortcode Execution vulnerability5.4 Medium
- happymonster happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.16.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- wppool flexstockWordPress FlexStock plugin <= 3.13.1 - SQL Injection Vulnerability7.6 High
- antoineh football poolWordPress Football Pool plugin <= 2.12.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability4.3 Medium
- olaf lederer eo4wpWordPress EO4WP plugin <= 1.0.8.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
mariadbUbuntumariadb vulnerabilityNo score- alfasado inc. powercms 4.x series, powercms 5.x series, powercms 6.x series +2 moreThe affected versions of PowerCMS allow HTTP header injection. This vulnerability can be...5.3 Medium
- xiaomi mi connect serviceMi Connect Service APP protocol flaws lead to leaking sensitive user information6.5 Medium
- xiaomi phone framework has unauthorized access vulnerabilityXiaomi phone framework has unauthorized access vulnerability7.3 High
- xiaomi phone frameworkXiaomi phone framework has unauthorized access vulnerability5.5 Medium
- xiaomi shop applicationxiaomi shop application Webview has code execution vulnerability4.3 Medium
- xiaomi quick app frameworkquick App has intent redriction vulnerability4.3 Medium
- tablepress, tobiasbg tablepress – tables in wordpress made easy +1 moreTablePress – Tables in WordPress made easy <= 3.0.4 - Authenticated (Author+) Stored Cross-Site Scripting6.4 Medium
- smackcoders export all posts, products, orders, refunds & usersExport All Posts, Products, Orders, Refunds & Users <= 2.13 - Unauthenticated PHP Object Injection9.8 Critical
- hcl software devops deploy / hcl launch, hcltechsw hcl devops deploy, hcl launch +2 moreHCL DevOps Deploy / HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability5.5 Medium
- fpt software nightwolf penetration platformCross Site Scripting in NightWolf Penetration Platform6.9 Medium
- zhangyd-c oneblogzhangyd-c OneBlog RestApiController.java autoLink server-side request forgery5.3 Medium
- zhangyd-c oneblogzhangyd-c OneBlog HTTP Header redos6.9 Medium
- mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统, mingyuefusu library management system +1 moremingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 cross-site request forgery5.3 Medium
- mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统, mingyuefusu library management system +1 moremingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 bookList getBookList sql injection5.3 Medium
- xiaomi smarthome applicationXiaomi smarthome application Webview has code execution vulnerability8.8 High
- dman25560 mediaviewMediaView <= 1.1.2 - Reflected Cross-Site Scripting via id Parameter6.1 Medium
- element-hq synapseSynapse vulnerable to federation denial of service via malformed events7.1 High
- wisc htcondorHTCondor 23.0.x before 23.0.22, 23.10.x before 23.10.22, 24.0.x before 24.0.6, and 24.6.x before...8.1 High
- libminglibming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHFILLSTYLES function.6.5 Medium
- libminglibming v0.4.8 was discovered to contain a segmentation fault via the decompileDUPLICATECLIP...6.5 Medium
- libminglibming v0.4.8 was discovered to contain a segmentation fault via the decompileGETMEMBER function...6.5 Medium
- libminglibming v0.4.8 was discovered to contain a segmentation fault via the decompileGETPROPERTY...6.5 Medium
- libminglibming v0.4.8 was discovered to contain a segmentation fault via the decompileSETVARIABLE function.6.5 Medium
- libmingAn allocation-size-too-big error in the parseSWF_DEFINEBINARYDATA function of libming v0.48...6.5 Medium
- libminglibming v0.4.8 was discovered to contain a segmentation fault via the decompileCALLMETHOD...6.5 Medium
- libminglibming v0.4.8 was discovered to contain a memory leak via the parseSWF_MORPHLINESTYLES function.6.5 Medium
- libminglibming v0.4.8 was discovered to contain a memory leak via the parseSWF_INITACTION function.6.5 Medium
- Show moreLoading…