CVEs published in March 2025
4,012 vulnerabilities, 401 critical, 26 exploited.
- pasqualepuzio login alertWordPress Login Alert plugin <= 0.2.1 - CSRF to Stored XSS vulnerability7.1 High
- preetinder singh tgg wp optimizerWordPress TGG WP Optimizer plugin <= 1.25 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- danielmuldernl omnileads scripts and tags managerWordPress OmniLeads Scripts and Tags Manager plugin <= 1.3 - CSRF to Stored XSS vulnerability7.1 High
- nazmur rahman text selection colorWordPress Text Selection Color plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- arjunthakur duplicate page and postWordPress Duplicate Page and Post plugin <= 1.0 - SQL Injection Vulnerability8.5 High
- cornershop better section navigation widgetWordPress Better Section Navigation Widget plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- webrangers clear sucuri cacheWordPress Clear Sucuri Cache plugin <= 1.4 - Broken Access Control Vulnerability5.3 Medium
- arjunthakur duplicate page and postWordPress Duplicate Page and Post plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- fancythemes page takeoverWordPress Page Takeover plugin <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- michele marri flattyWordPress Flatty plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- matthewprice1178 wp database optimizerWordPress WP Database Optimizer plugin <= 1.2.1.3 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- matthewprice1178 wp database optimizerWordPress WP Database Optimizer plugin <= 1.2.1.3 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- quyle91 administrator zAdministrator Z <= 2025.03.24 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- clinic queuing system queuing system, oretnom23 clinic queuing system +1 moreReflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System4.8 Medium
- clinic queuing system queuing system, oretnom23 clinic queuing system +1 moreReflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System4.8 Medium
- clinic queuing system queuing system, oretnom23 clinic queuing system +1 moreReflected Cross-Site Scripting (XSS) vulnerability in Clinic Queuing System4.8 Medium
- fortinet fortiddos, fortiddos-cm, fortimail +3 more +5 moreAn exposure of sensitive system information to an unauthorized control sphere vulnerability [CWE...5.0 Medium
- gitlabAllocation of Resources Without Limits or Throttling in GitLab4.3 Medium
- gitlabInsufficient Granularity of Access Control in GitLab5.2 Medium
- videowhisper micropaymentsWordPress MicroPayments plugin <= 2.9.29 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bensibley unlimitedWordPress Unlimited plugin <= 1.45 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- wp compress for mainwpWordPress WP Compress for MainWP plugin <= 6.30.03 - Server Side Request Forgery (SSRF) vulnerability4.9 Medium
- usermavenWordPress Usermaven plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- ultimate blocks blocksWordPress Ultimate Blocks plugin <= 3.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- zeen101 leaky paywallWordPress Leaky Paywall plugin <= 4.21.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 2.14.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- redpixelstudios rps include contentWordPress RPS Include Content plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- alordiel dropdown multisite selectorWordPress Dropdown Multisite selector plugin < 0.9.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- teastudio.pl wp posts carouselWordPress WP Posts Carousel plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- bestweblayout slider by bestwebsoftWordPress Slider by BestWebSoft plugin <= 1.1.0 - SQL Injection Vulnerability7.6 High
- wpxpo postxWordPress PostX plugin <= 4.1.25 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- bob hostelWordPress Hostel plugin <= 1.1.5.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- shipmondo – a complete shipping solution for woocommerceWordPress Shipmondo – A complete shipping solution for WooCommerce plugin <= 5.0.3 - Authenticated Arbitrary WordPress Option Disclosure vulnerability6.5 Medium
- fortinet forticlientemsAn Improper Neutralization of Input During Web Page Generation in FortiClientEMS version 6.2.0...5.4 Medium
- tagdiv composertagDiv Composer <= 5.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- kddi corporation hgw-bl1500hmImproper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in...8.1 High
- kddi corporation hgw-bl1500hmImproper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in...2.1 Low
- kddi corporation hgw-bl1500hmImproper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in...8.8 High
- kddi corporation hgw-bl1500hmImproper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in...6.5 Medium
- kddi corporation hgw-bl1500hmCross-site scripting vulnerability exists in the USB storage file-sharing function of HGW...3.6 Low
- kddi corporation hgw-bl1500hmCross-site scripting vulnerability exists in the NickName registration screen of HGW-BL1500HM Ver...5.4 Medium
- webfactory advanced google recaptchaAdvanced Google reCAPTCHA <= 1.29 - Authenticated (Subscriber+) Limited SQL Injection via 'sSearch' Parameter5.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia <= 1.2.19 - Unauthenticated Full Path Disclosure5.3 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated PHP Object Injection via PHAR to Arbitrary File Deletion7.5 High
- glenwpcoder drag and drop multiple file upload for contact form 7, codedropz drag and drop multiple file upload - contact form 7 +1 moreDrag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.7 - Unauthenticated Arbitrary File Deletion8.8 High
- unknown event tickets with ticket scannerEvent Tickets with Ticket Scanner < 2.5.4 - Arbitrary Tickets Deletion via CSRF4.3 Medium
- asus asciA double free vulnerability has been identified in the ASUS System Analysis service. This...5.9 Medium
- tagdiv composertagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'account_id' and 'account_username'6.1 Medium
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion9.8 Critical
- unitree go1, go1 firmware +1 moreUnitree Go1 Robot Dog Backdoor Control Channel6.6 Medium
- Show moreLoading…