CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- eliot akira admin menu post listWordPress Admin Menu Post List plugin <= 2.0.7 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- joe waymarkWordPress Waymark plugin <= 1.5.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- bozdoz recaptcha jetpackWordPress reCAPTCHA Jetpack plugin <= 0.2.2 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- uncodethemes ultra demo importerWordPress Ultra Demo Importer plugin <= 1.0.5 - CSRF to RCE vulnerability9.6 Critical
- oleglark vkontakte cross-postWordPress VKontakte Cross-Post plugin <= 0.3.2 - CSRF to Stored XSS vulnerability7.1 High
- squiter spoiler blockWordPress Spoiler Block plugin <= 1.7 - CSRF to Stored XSS vulnerability7.1 High
- wpwax logo showcase ultimateWordPress Logo Showcase Ultimate plugin <= 1.4.4 - Local File Inclusion vulnerability6.5 Medium
- dimafreund rentsystWordPress RentSyst plugin <= 2.0.92 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- sudavar codescar radio widgetWordPress Codescar Radio Widget plugin <= 0.4.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- jconti link shieldWordPress Link Shield plugin <= 0.5.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- lemmentwickler epaper lister for yumpuWordPress ePaper Lister for Yumpu plugin <= 1.4.0 - CSRF to Stored XSS vulnerability7.1 High
- scand multimailerWordPress MultiMailer plugin <= 1.0.3 - CSRF to Stored XSS vulnerability7.1 High
- hossainawlad ald login pageWordPress ALD Login Page plugin <= 1.1 - CSRF to Stored XSS vulnerability7.1 High
- gtlwpdev all push notification for wpWordPress All push notification for WP Plugin <= 1.5.3 - CSRF to SQL Injection vulnerability8.2 High
- hivedigital canonical attachmentsWordPress Canonical Attachments Plugin <= 1.8 - Stored Cross Site Scripting (XSS) vulnerability7.1 High
- clickandpledge click & pledge connect pluginWordPress Click & Pledge Connect Plugin Plugin <= 2.24080000-WP6.6.1 - SQL Injection vulnerability7.2 High
- sandor kovacs simple post meta managerWordPress Simple Post Meta Manager Plugin <= 1.0.9 - CSRF to Reflected Cross-Site Scripting vulnerability7.1 High
- edamam seo, nutrition and print for recipes by edamamWordPress SEO, Nutrition and Print for Recipes by Edamam plugin <= 3.3 - CSRF to Cross-Site Scripting vulnerability7.1 High
- reve chat chatWordPress REVE Chat plugin <= 6.4.4 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- chillpay woocommerceWordPress ChillPay WooCommerce Plugin <= 2.5.3 - CSRF to Stored XSS vulnerability7.1 High
- dangrossman wp calais auto taggerWordPress WP Calais Auto Tagger plugin <= 2.0 - CSRF to Stored XSS vulnerability7.1 High
- axew3 wp w3all phpbbWordPress WP w3all phpBB Plugin <= 2.9.9 - CSRF to Stored XSS vulnerability7.1 High
- debounce email validatorWordPress DeBounce Email Validator plugin <= 5.7.1 - CSRF to Stored XSS vulnerability7.1 High
- agence web eoxia - montpellier wp shopWordPress WP shop plugin <= 2.6.1 - CSRF to Arbitrary File Upload vulnerability9.6 Critical
- ankit singla wordpress spam blockerWordPress WordPress Spam Blocker Plugin <= 2.0.5 - CSRF to Stored XSS vulnerability7.1 High
- chat2WordPress Chat2 plugin <= 4.0 - CSRF to Stored XSS vulnerability7.1 High
- george sexton wordpress events calendar plugin – connectdailyWordPress WordPress Events Calendar Plugin – connectDaily plugin <= 1.5.4 - CSRF to Cross-Site Scripting vulnerability7.1 High
- kevon adonis wp abstractsWordPress WP Abstracts Plugin <= 2.7.5 - CSRF to Stored XSS vulnerability7.1 High
- rafasashi user session synchronizerWordPress User Session Synchronizer plugin <= 1.4.0 - CSRF to Stored XSS vulnerability7.1 High
- foliovision foliopress wysiwygWordPress Foliopress WYSIWYG plugin <= 2.6.18 - CSRF to Stored XSS vulnerability7.1 High
- nimbata call trackingWordPress Nimbata Call Tracking plugin <= 1.7.4 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- ydesignservices multiple location google mapWordPress Multiple Location Google Map plugin <= 1.1 - CSRF to Stored XSS vulnerability7.1 High
- vsourz digital wp map route plannerWordPress WP Map Route Planner plugin <= 1.0.0 - CSRF to Stored XSS vulnerability7.1 High
- keycaptchaWordPress KeyCAPTCHA plugin <= 2.5.1 - CSRF to Stored XSS vulnerability7.1 High
- plainware plaininventoryWordPress PlainInventory plugin <= 3.1.9 - CSRF to Stored XSS vulnerability7.1 High
- czater czater.pl – live chat i telefonWordPress Czater.pl – live chat i telefon plugin <= 1.0.5 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- anantaddons anant addons for elementorWordPress Anant Addons for Elementor plugin <= 1.1.8 - CSRF to Arbitrary Plugin Installation vulnerability9.6 Critical
- elementor allyWordPress One Click Accessibility plugin <= 3.1.0 - Cross-Site Scripting (XSS) vulnerability5.9 Medium
- appsbd vite couponWordPress Vite Coupon plugin <= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerability9.6 Critical
- hiren patel custom posts orderWordPress Custom Posts Order Plugin <= 4.4 - CSRF to Stored Cross Site Scripting (XSS) vulnerability7.1 High
- ip2location world clockWordPress IP2Location World Clock Plugin <= 1.1.9 - CSRF to Stored XSS vulnerability7.1 High
- fraudlabspro fraudlabs pro for woocommerceWordPress FraudLabs Pro for WooCommerce plugin <= 2.22.8 - CSRF to Stored XSS vulnerability7.1 High
- ashokbasnet nepali date utilitiesWordPress Nepali Date Utilities plugin <= 1.0.15 - CSRF to Stored XSS vulnerability7.1 High
- wp map plugins interactive us mapWordPress Interactive US Map plugin <= 2.7 - CSRF to Stored XSS vulnerability7.1 High
- fromdoppler doppler formsWordPress Doppler Forms plugin <= 2.5.1 - CSRF to Stored XSS vulnerability7.1 High
- epeken all kurirWordPress Epeken All Kurir plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- mergado packWordPress Mergado Pack plugin <= 4.2.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- quantumcloud seo helpWordPress SEO Help plugin <= 6.7.9 - Server Side Request Forgery (SSRF) vulnerability6.8 Medium
- solwininfotech wp social stream designerWordPress WP Social Stream Designer plugin <= 1.3 - SQL Injection vulnerability7.6 High
- picture-planet gmbh verowa connectWordPress Verowa Connect plugin <= 3.0.5 - SQL Injection vulnerability7.6 High
- Show moreLoading…