CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- codesolz ultimate push notificationsWordPress Ultimate Push Notifications plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- madfishdigital bulk noindex & nofollow toolkitWordPress Bulk NoIndex & NoFollow Toolkit plugin <= 2.16 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- shopperdotcom shopperWordPress Shopper plugin <= 3.2.5 - SQL Injection vulnerability9.3 Critical
- click5 history log by click5WordPress History Log by click5 plugin <= 1.0.13 - SQL Injection vulnerability9.3 Critical
- wp messiah mobile bottom menuWordPress WP Mobile Bottom Menu plugin <= 1.4.0 - Broken Access Control vulnerability4.3 Medium
- rzfarrell cgm event calendarWordPress CGM Event Calendar plugin <= 0.8.5 - Cross Site Scripting (XSS) Vulnerability7.1 High
- mayeenul islam nanosupportWordPress NanoSupport plugin <= 0.6.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound limit max ips per userWordPress Limit Max IPs Per User plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- arefly delete post revisionWordPress Delete Post Revision plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jiangmiao wp cleanerWordPress WP Cleaner plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound pages orderWordPress Pages Order plugin <= 1.1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- s wordpress galleriaWordPress WordPress Galleria plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- conlabz gmbh wp bookmarksWordPress WP Bookmarks plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- hossein material dashboardWordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability8.1 High
- fahad mahmood order splitter for woocommerceWordPress Order Splitter for WooCommerce plugin <= 5.3.0 - SQL Injection Vulnerability8.5 High
- nick mcreynolds product table by wbwWordPress Product Table by WBW plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- michel - xiligroup dev xili-languageWordPress xili-language plugin <= 2.21.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- infornweb news & blog designer packWordPress News & Blog Designer Pack plugin <= 4.0 - Local File Inclusion vulnerability8.1 High
- shortpixel enable media replaceWordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- link software llc html formsWordPress HTML Forms plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- enituretechnology small package quotes – worldwide express editionWordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.18 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- podpirate access areasWordPress Access Areas Plugin <= 1.5.19 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- coffee code tech plugin oficial – getnet para woocommerceWordPress Plugin Oficial – Getnet para WooCommerce plugin <= 1.7.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro secure copy content protection and content lockingWordPress Secure Copy Content Protection and Content Locking plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- magepeopleteam wptravellyWordPress WpTravelly Plugin <= 1.8.7 - PHP Object Injection vulnerability8.8 High
- shortpixel adaptive imagesWordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerability5.4 Medium
- emotionalonlinestorytelling oracle cards liteWordPress Oracle Cards Lite plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) Vulnerability7.1 High
- bob watu quizWordPress Watu Quiz plugin <= 3.4.2 - Reflected Cross Site Scripting (XSS) Vulnerability7.1 High
- adamskaat countdown & clockWordPress Countdown & Clock plugin <=2.8.8 - Remote Code Execution (RCE) vulnerability9.9 Critical
- wpclever wpc smart linked products - upsells & cross-sells for woocommerceWordPress WPC Smart Linked Products plugin <= 1.3.5 - Privilege Escalation vulnerability8.8 High
- martin nguyen next-cart store to woocommerce migrationWordPress Next-Cart Store to WooCommerce Migration plugin <= 3.9.4 - SQL Injection vulnerability9.3 Critical
- vikas ratudi vpsuformWordPress VForm plugin <= 3.1.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- kellydiek digiwidgets image editorWordPress DigiWidgets Image Editor plugin <= 1.10 - Remote Code Execution (RCE) Vulnerability10.0 Critical
- abhishek kumar frizzlyWordPress Frizzly plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- animesh kumar advanced speed increaserWordPress Advanced Speed Increaser Plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- sourcecodester clinic's patient management systemClinics Patient Management System SQL Injection9.3 Critical
- @tanstack react-routerRemix and React Router allow URL manipulation via Host / X-Forwarded-Host headers7.5 High
- hewlett packard enterprise (hpe) virtual intranet access (via)Arbitrary File Overwrite in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows Client5.5 Medium
- linux, linux kernel +1 morenet: switchdev: Convert blocking notification chain to a raw one5.5 Medium
- linux, linux kernel +1 moredrm/amd/display: Fix out-of-bound accesses7.8 High
- linux, linux kernel +1 moremm: fix kernel BUG when userfaultfd_move encounters swapcache7.8 High
- linux, linux kernel +1 moremm/slab/kvfree_rcu: Switch to WQ_MEM_RECLAIM wq7.8 High
- linux, linux kernel +1 morepinctrl: nuvoton: npcm8xx: Add NULL check in npcm8xx_gpio_fw5.5 Medium
- linux, linux kernel +1 moreice: fix memory leak in aRFS after reset5.5 Medium
- linux, linux kernel +1 moresched: address a potential NULL pointer dereference in the GRED scheduler.5.5 Medium
- linux, linux kernel +1 morewifi: cfg80211: cancel wiphy_work before freeing wiphy7.8 High
- linux, linux kernel +1 moredrm/hyperv: Fix address space leak when Hyper-V DRM device is removed5.5 Medium
- linux, linux kernel +1 morefbdev: hyperv_fb: Fix hang in kdump kernel when on Hyper-V Gen 2 VMs5.5 Medium
- linux, linux kernel +1 morefbdev: hyperv_fb: Allow graceful removal of framebuffer7.8 High
- linux, linux kernel +1 morenet/mlx5: handle errors in mlx5_chains_create_table()5.5 Medium
- Show moreLoading…