CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- vlad.olaru fontoWordPress Fonto plugin <= 1.2.2 - Arbitrary File Download vulnerability4.9 Medium
- pixelgrade category iconWordPress Category Icon plugin <= 1.0.1 - Arbitrary File Download vulnerability4.9 Medium
- publitioWordPress Publitio plugin <= 2.2.0 - Arbitrary File Read vulnerability6.5 Medium
- plugin devs shopify to woocommerce migrationWordPress Shopify to WooCommerce Migration plugin <= 1.3.0 - Settings Change vulnerability6.5 Medium
- web ready now wr price list manager for woocommerceWordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Arbitrary Content Deletion vulnerability5.4 Medium
- matat technologies textme smsWordPress TextMe SMS plugin <= 1.9.1 - Broken Access Control vulnerability6.5 Medium
- otwthemes widget manager lightWordPress Widget Manager Light plugin <= 1.18 - Broken Access Control vulnerability6.5 Medium
- binarycarpenter free woocommerce product table viewWordPress Free Woocommerce Product Table View plugin <= 1.78 - Arbitrary Content Deletion vulnerability6.5 Medium
- think201 clientsWordPress Clients plugin <= 1.1.4 - Broken Access Control vulnerability6.4 Medium
- manuel schmalstieg minimalistic event managerWordPress Minimalistic Event Manager plugin <= 1.1.1 - Broken Access Control vulnerability6.4 Medium
- richtexteditor rich text editorWordPress Rich Text Editor Plugin <= 1.0.1 - Broken Access Control vulnerability6.5 Medium
- jeffikus wootumblogWordPress WooTumblog plugin <= 2.1.4 - Content Injection vulnerability6.5 Medium
- alisaleem252 support helpdesk ticket system liteWordPress Support Helpdesk Ticket System Lite plugin <= 4.5.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- utkarsh kukreti advanced typekitWordPress Advanced Typekit plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ashish ajani contact form vcard generatorWordPress Contact Form vCard Generator plugin <= 2.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- sandeep kumar wp video playlistWordPress WP Video Playlist plugin <= 1.1.2 - Settings Change vulnerability6.5 Medium
- pepro dev. group peprodev cf7 databaseWordPress PeproDev CF7 Database plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- greg tailpressWordPress TailPress plugin <= 0.4.4 - Sensitive Data Exposure vulnerability5.8 Medium
- docxpressoWordPress Docxpresso plugin <= 2.6 - Arbitrary File Download vulnerability5.9 Medium
- turitop booking systemWordPress TuriTop Booking System plugin <= 1.0.10 - Broken Access Control vulnerability6.5 Medium
- moshensky cf7 spreadsheetsWordPress CF7 Spreadsheets plugin <= 2.3.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound wp identiconWordPress WP_Identicon plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- miro.mannino flickr photostreamWordPress Flickr Photostream plugin <= 3.1.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- e1tekoap42 search engine keywords highlighterWordPress Search engine keywords highlighter plugin <= 0.1.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- angelo mandato blubrry powerpress podcasting plugin multisite add-onWordPress Blubrry PowerPress Podcasting plugin MultiSite add-on plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- debounce email validatorWordPress DeBounce Email Validator plugin <= 5.7 - Local File Inclusion Vulnerability7.5 High
- creativemindssolutions cm header and footerWordPress CM Header and Footer plugin <= 1.2.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- enituretechnology residential address detectionWordPress Residential Address Detection plugin <= 2.5.4 - Broken Access Control vulnerability6.5 Medium
- enituretechnology small package quotes – worldwide express editionWordPress Small Package Quotes – Worldwide Express Edition plugin <= 5.2.19 - Broken Access Control vulnerability6.5 Medium
- shamalli web directory freeWordPress Web Directory Free plugin <= 1.7.6 - CSRF to Cross Site Scripting (XSS) vulnerability7.1 High
- pickplugins testimonial sliderWordPress Testimonial Slider plugin <= 2.0.13 - PHP Object Injection vulnerability8.8 High
- tribulant software snow stormWordPress Snow Storm plugin <= 1.4.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- david wood latest custom post type updatesWordPress Latest Custom Post Type Updates plugin <= 1.3.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- notfound wptobe-signinupWordPress Wptobe-signinup plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- tstafford include-fileWordPress include-file plugin <= 1 - Arbitrary File Download Vulnerability6.5 Medium
- api-platform coreAPI Platform Core can leak exceptions message that may contain sensitive information5.3 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreCross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 49.1 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment9.9 Critical
- wpchill modula image gallery, modula image gallery – photo grid & video gallery +1 moreModula Image Gallery <= 2.10.1 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox 5 JavaScript Library6.4 Medium
- gitoxidelabs gitoxidegitoxide does not detect SHA-1 collision attacks6.8 Medium
- theluckywp luckywp table of contentsLuckyWP Table of Contents <= 2.1.10 - Cross-Site Request Forgery to Reflected Cross-Site Scripting6.1 Medium
- linux, linux kernel +1 moreKVM: arm64: Unconditionally save+flush host FPSIMD/SVE/SME state7.3 High
- apache traffic serverApache Traffic Server: Malformed chunked message body allows request smuggling7.5 High
- caipeichao thinkoxcaipeichao ThinkOX Search search.html cross site scripting5.1 Medium
- code-projects gym management systemSourceCodester Gym Management System signup.php sql injection6.9 Medium
- itning student homework management system, student-homework-management-system +1 moreitning Student Homework Management System cross-site request forgery5.3 Medium
- itning student homework management system, student-homework-management-system +1 moreitning Student Homework Management System Edit Job Page fileupload cross site scripting4.8 Medium
- specialk user submitted posts – enable users to submit posts from the front endUser Submitted Posts <= 20241026 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- unitecms unlimited elements for elementorUnlimited Elements For Elementor <= 1.5.142 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bigboomdesign big boom directoryBig Boom Directory <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- Show moreLoading…