CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- catch themes dark mode, catchthemes catch dark mode +1 moreWordPress Catch Dark Mode plugin <= 2.0.1 - Local File Inclusion vulnerability7.5 High
- vinagecko vg woocarouselWordPress VG WooCarousel plugin <= 1.3 - Local File Inclusion vulnerability7.5 High
- essential plugin slider a sliderspackWordPress Slider a SlidersPack Plugin <= 2.3 - Local File Inclusion vulnerability7.5 High
- themekraft buddyformsWordPress BuddyForms plugin <= 2.10.2 - Local File Inclusion vulnerability7.5 High
- rameez iqbal real estate managerWordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability7.5 High
- mtrv teachpressWordPress teachPress plugin <= 9.0.11 - SQL Injection vulnerability8.5 High
- daisycon prijsvergelijkersWordPress Daisycon prijsvergelijkers plugin <= 4.8.4 - SQL Injection vulnerability8.5 High
- coothemes easy wp optimizerWordPress Easy WP Optimizer Plugin <= 1.1.0 - Broken Access Control vulnerability8.8 High
- joomsky js job managerWordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability8.8 High
- stylemix motorsWordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability8.8 High
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.5.28 - Local File Inclusion vulnerability8.8 High
- supsystic easy google mapsWordPress Easy Google Maps plugin <= 1.11.18 - XML External Entity vulnerability6.6 Medium
- cristián lávaque s2memberWordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability4.9 Medium
- activecampaignWordPress ActiveCampaign Plugin <= 8.1.16 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- rocketelements split test for elementorWordPress Split Test For Elementor plugin <= 1.8.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- kaizencoders url shortifyWordPress URL Shortify Plugin <= 1.10.5.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ays pro secure copy content protection and content lockingWordPress Secure Copy Content Protection and Content Locking plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- funnelcockpitWordPress FunnelCockpit Plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- socialintents social intentsWordPress Social Intents plugin <= 1.6.19 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- data443 risk migitation, inc. posts footer managerWordPress Posts Footer Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- data443 risk migitation, inc. welcome barWordPress Welcome Bar plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- onoffice gmbh for wp-websites, onofficeweb onoffice for wp-websites +1 moreWordPress onOffice for WP-Websites plugin <= 5.7 - SQL Injection vulnerability7.6 High
- cmsminds pay with contact form 7WordPress Pay with Contact Form 7 Plugin <= 1.0.4 - SQL Injection vulnerability7.6 High
- silvasoft boekhoudenWordPress Silvasoft boekhouden plugin <= 3.0.6 - SQL Injection vulnerability7.6 High
- eleopard behance portfolio managerWordPress Behance Portfolio Manager plugin <= 1.7.5 - SQL Injection vulnerability7.6 High
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - SQL Injection vulnerability7.6 High
- suiteplugins video & photo gallery for ultimate memberWordPress Video & Photo Gallery for Ultimate Member plugin <= 1.1.3 - SQL Injection vulnerability7.6 High
- edanzer easy query – wp query builderWordPress Easy Query – WP Query Builder plugin <= 2.0.4 - SQL Injection Vulnerability7.6 High
- niteothemes cmp – coming soon & maintenanceWordPress CMP – Coming Soon & Maintenance plugin <= 4.1.14 - Remote Code Execution (RCE) vulnerability9.1 Critical
- renzo tejada libro de reclamaciones y quejasWordPress Libro de Reclamaciones y Quejas plugin <= 1.0 - CSRF to Stored XSS vulnerability7.1 High
- otwthemes sidebar manager lightWordPress Sidebar Manager Light plugin <= 1.18 - CSRF to Stored XSS vulnerability7.1 High
- imagination technologies graphics ddkGPU DDK - PhysmemWrapExtMem uiSize=0 corrupts kernel memory7.8 High
- imagination technologies graphics ddkGPU DDK - ui64RobustnessAddress can overwrite Freelist / HWRT (and bypass PMMETA)7.1 High
- xujiangfei admintwoxujiangfei admintwo insertTree cross site scripting5.1 Medium
- xujiangfei admintwoxujiangfei admintwo add cross site scripting5.1 Medium
- xujiangfei admintwoxujiangfei admintwo updateSet cross site scripting5.1 Medium
- eladminelunez eladmin Maintenance Management Module testConnect deserialization5.3 Medium
- aiven aiven-extrasaiven-extras allows PostgreSQL Privilege Escalation through format function9.1 Critical
- bentomlBentoML Allows Remote Code Execution (RCE) via Insecure Deserialization9.8 Critical
- totolink a6000r, a6000r firmware +1 moreTOTOLINK A6000R mtkwifi.lua apcli_cancel_wps command injection5.3 Medium
- eniture technology pallet packaging for woocommerceWordPress Pallet Packaging for WooCommerce Plugin <= 1.1.15 - Broken Access Control vulnerability6.5 Medium
- joshix simplishWordPress Simplish theme <= 2.6.4 - Stored Cross Site Scripting (XSS) vulnerability6.5 Medium
- favethemes homeyWordPress Homey theme <= 2.4.1 - Privilege Escalation vulnerability9.8 Critical
- shiptrack booking calendar and notificationWordPress Booking Calendar and Notification plugin <= 4.0.3 - Broken Authentication vulnerability6.5 Medium
- xtendify woffice, woffice crm +1 moreWoffice <= 5.4.21 - Authentication Bypass via Registration Role9.8 Critical
- aviplugins videosWordPress Videos plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- introvoke inc. dba sequel.io sequelWordPress Sequel plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- shiptrack booking calendar and notificationWordPress Booking Calendar and Notification plugin <= 4.0.3 - SQL Injection vulnerability9.3 Critical
- zankover fami woocommerce compareWordPress Fami WooCommerce Compare plugin <= 1.0.5 - Local File Inclusion vulnerability7.5 High
- directorythemes tigerWordPress Tiger theme <= 2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- Show moreLoading…