CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- qinguoyi tinywebserverqinguoyi TinyWebServer http_conn.cpp sql injection5.3 Medium
- qinguoyi tinywebserverqinguoyi TinyWebServer http_conn.cpp stack-based overflow6.9 Medium
- phpgurukul e-diary management systemPHPGurukul e-Diary Management System add-category.php sql injection6.9 Medium
- tenda rx3, rx3 firmware +1 moreTenda RX3 SetOnlineDevName formSetDeviceName stack-based overflow8.7 High
- phpgurukul old age home management systemPHPGurukul Old Age Home Management System search.php sql injection6.9 Medium
- xujiangfei admintwoxujiangfei admintwo updateSet cross-site request forgery5.3 Medium
- xujiangfei admintwoxujiangfei admintwo updateSet access control5.3 Medium
- xujiangfei admintwoxujiangfei admintwo home access control5.3 Medium
- xujiangfei admintwoxujiangfei admintwo add server-side request forgery5.3 Medium
- 6storage rentalsWordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability5.4 Medium
- rollbarWordPress Rollbar plugin <= 2.7.1 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- joao romao social share buttons & analytics plugin – getsocial.ioWordPress Social Share Buttons & Analytics Plugin plugin <= 4.5 - Broken Access Control vulnerability4.3 Medium
- shivam mani tripathi privyr crm integrationWordPress Privyr CRM plugin <= 1.0.2 - Broken Access Control vulnerability5.4 Medium
- wedevs wp project managerWordPress WP Project Manager plugin < 2.6.25 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- wprio table block by riovizualWordPress Table Block by RioVizual plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 3.8213 - Broken Access Control vulnerability4.3 Medium
- quý lê 91 administrator zWordPress Administrator Z plugin <= 2026.03.02 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- axew3 wp w3all phpbbWordPress w3all phpBB integration Plugin <= 2.9.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- freetobook responsive widgetWordPress Freetobook Responsive Widget Plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- pickplugins wishlistWordPress Wishlist plugin <= 1.0.46 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- ablancodev woocommerce role pricingWordPress Woocommerce Role Pricing Plugin <= 3.5.6 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- broadstreet adsWordPress Broadstreet plugin <= 1.52.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability4.3 Medium
- crm perks wp zendesk for contact form 7, wpforms, elementor, formidable and ninja formsWordPress WP Zendesk for Contact Form 7, WPForms, Elementor, Formidable and Ninja Forms Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability4.3 Medium
- www.15.to qr code tag for wcWordPress QR Code Tag for WC plugin <= 1.9.42 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wpzinc post to social media – wordpress to hootsuiteWordPress WP to Hootsuite plugin <= 1.5.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wp-buy 404 image redirection (replace broken images)WordPress 404 Image Redirection (Replace Broken Images) plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- hossni mubarak jobwpWordPress JobWP plugin <= 2.3.9 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- saiful islam ultraaddons elementor liteWordPress UltraAddons – Elementor Addons plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- berocket sequential order numbers for woocommerceWordPress Sequential Order Numbers for WooCommerce plugin <= 3.6.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- robert d payne rdp wiki embedWordPress RDP Wiki Embed plugin <= 1.2.20 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- kuppuraj advanced all in one admin search by wp spotlightWordPress Advanced All in One Admin Search by WP Spotlight plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- infogiants simple website logoWordPress Simple Website Logo plugin <= 1.1 - Broken Access Control vulnerability5.3 Medium
- 1clickmigration 1 click wordpress migrationWordPress 1 Click WordPress Migration plugin <= 2.5.7 - Sensitive Data Exposure vulnerability5.3 Medium
- devsoftbaltic surveyjsWordPress SurveyJS plugin <= 1.12.20 - Broken Access Control vulnerability5.3 Medium
- era404 stafflistWordPress StaffList plugin <= 3.2.7 - Sensitive Data Exposure vulnerability5.3 Medium
- iqonic wpbookitWordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerability5.3 Medium
- commotion course booking systemWordPress Course Booking System Plugin <= 6.1 - Broken Access Control vulnerability5.3 Medium
- black and white wp genealogy – your family history websiteWordPress WP Genealogy plugin <= 0.1.9 - Broken Access Control vulnerability5.3 Medium
- j. tyler wiest jetpack feedback exporterWordPress Jetpack Feedback Exporter plugin <= 1.23 - Sensitive Data Exposure Vulnerability5.3 Medium
- designinvento directorypressWordPress DirectoryPress Plugin <= 3.6.22 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- swiftxr (3d/ar/vr) viewerWordPress SwiftXR (3D/AR/VR) Viewer plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- abcdatos ai content creatorWordPress AI Content Creator plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- tim nguyen 1-click backup & restore databaseWordPress 1-Click Backup & Restore Database plugin <= 1.0.3 - Broken Access Control Vulnerability5.4 Medium
- cleverreach® official cleverreach plugin for woocommerceWordPress Official CleverReach WooCommerce Integration plugin <= 3.4.6 - CSRF to Settings Change vulnerability6.5 Medium
- vcita online booking & scheduling calendar for wordpress by vcita, online booking \& scheduling calendar +1 moreWordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Sensitive Data Exposure vulnerability4.3 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.5.28 - Broken Access Control vulnerability4.3 Medium
- sonaar mp3 audio player for music, radio & podcast by sonaarWordPress MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin <= 5.9.4 - Broken Access Control vulnerability4.3 Medium
- aleswebs admail – multilingual back in-stock notifier for woocommerceWordPress AdMail plugin <= 1.7.0 - Broken Access Control vulnerability4.3 Medium
- wp chill revive.soWordPress Revive.so plugin <= 2.0.3 - Broken Access Control vulnerability4.3 Medium
- era404 stafflistWordPress StaffList plugin <= 3.2.7 - Broken Access Control vulnerability4.3 Medium
- Show moreLoading…