CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- hive support supportWordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerability6.5 Medium
- notfound site notifyWordPress Site Notify plugin <= 1.0 - Broken Access Control Vulnerability6.5 Medium
- vagonic woocommerce products reorder drag drop multiple sort – sortable, rearrange products vagonicWordPress Woocommerce Products Reorder Drag Drop Multiple Sort plugin <= 1.9 - Broken Access Control vulnerability4.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.4.0 - HTML Injection vulnerability4.3 Medium
- wp messiah ai image alt text generator for wpWordPress Ai Image Alt Text Generator for WP plugin <= 1.1.9 - Sensitive Data Exposure vulnerability4.3 Medium
- asgaros forumWordPress Asgaros Forum plugin <= 3.0.0 - File Upload Numbers Bypass vulnerability4.3 Medium
- spider themes eazydocsWordPress EazyDocs plugin <= 2.7.1 - Broken Access Control vulnerability5.4 Medium
- spider themes elementsWordPress Spider Elements – Addons for Elementor plugin <= 1.6.6 - Broken Access Control vulnerability6.4 Medium
- ability, inc accessibility suiteWordPress Accessibility Suite plugin <= 4.18 - Arbitrary File Upload vulnerability6.5 Medium
- hive support supportWordPress Hive Support plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- flothemesplugins flo formsWordPress Flo Forms plugin <= 1.0.43 - Broken Access Control vulnerability6.5 Medium
- specia theme companionWordPress Specia Companion plugin <= 6.3 - Broken Access Control vulnerability6.5 Medium
- creativemindssolutions cm registration and invitation codesWordPress CM Registration and Invitation Codes plugin <= 2.5.6 - Broken Access Control vulnerability6.5 Medium
- totalprocessing nomupay payment processing gatewayWordPress Total processing card payments for WooCommerce Plugin <= 7.1.5 - Arbitrary File Download vulnerability6.5 Medium
- hive support supportWordPress Hive Support plugin <= 1.2.5 - Broken Access Control vulnerability6.5 Medium
- labcat processing projectsWordPress Processing Projects Plugin <= 1.0.2 - Arbitrary File Upload vulnerability9.1 Critical
- piotnetdotcom piotnet formsWordPress Piotnet Forms plugin <= 1.0.30 - Path Traversal vulnerability2.7 Low
- brian batt - elearningfreak.com insert or embed articulate content into wordpressWordPress Insert or Embed Articulate Content into WordPress plugin <= 4.3000000025 - Arbitrary File Upload vulnerability9.1 Critical
- eyale-vc contact form builder by vcitaWordPress Contact Form Builder by vcita plugin <= 4.10.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brizyWordPress Brizy plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ashan perera eventonWordPress EventON plugin <= 2.4.1 - Local File Inclusion vulnerability7.5 High
- athemes addons for elementor, smub athemes addons for elementor +1 moreWordPress aThemes Addons for Elementor plugin <= 1.1.3 - Local File Inclusion vulnerability7.5 High
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 4.3.6 - PHP Object Injection vulnerability8.8 High
- nirmal kumar ram wp remote thumbnailWordPress WP Remote Thumbnail Plugin <= 1.3.2 - Arbitrary File Upload vulnerability9.9 Critical
- bradvin foobox image lightboxWordPress Lightbox & Modal Popup WordPress Plugin – FooBox plugin <= 2.7.33 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- aaronfrey nearby locationsWordPress Nearby Locations Plugin <= 1.1.1 - SQL Injection vulnerability7.6 High
- cardgate payments for woocommerceWordPress CardGate Payments for WooCommerce plugin <= 3.2.1 - SQL Injection vulnerability8.2 High
- studi7 qr masterWordPress QR Master plugin <= 1.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- otwthemes popping content lightWordPress Popping Content Light plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- 5sterrenspecialist wordpress 5sterrenspecialist pluginWordPress 5sterrenspecialist plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- john james jacoby wp user profilesWordPress WP User Profiles plugin <= 2.6.2 - Privilege Escalation vulnerability8.8 High
- magnigenie review stars count for woocommerceWordPress Review Stars Count For WooCommerce plugin <= 2.0 - SQL Injection Vulnerability8.5 High
- rameez iqbal real estate managerWordPress Real Estate Manager plugin <= 7.3 - Local File Inclusion vulnerability8.1 High
- aytechnet dyapress erp/crmWordPress DyaPress ERP/CRM plugin <= 18.0.2.0 - Local File Inclusion Vulnerability8.1 High
apparmorSUSE,libapparmorSUSE +1 moreSecurity update for apparmorNo score- checkmkLivestatus command injection in RestAPI6.0 Medium
- stringfold embedderEmbedder 1.3 - 1.3.5 - Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- vikashsrivastava1111989 order postORDER POST <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- accredible certificates & open badgesAccredible Certificates & Open Badges <= 1.4.9 - Authenticated (Administrator+) SQL Injection via orderby Parameter4.9 Medium
- azurecurve shortcodes in commentsazurecurve Shortcodes in Comments <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution7.3 High
- hasthemes swatchly – woocommerce variation swatches for products (product attributes: image swatch, color swatches, label swatches)Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) 1.2.8 - 1.4.0 - Missing Authorization to Authenticated (Subscriber+) Limited O…6.5 Medium
- kendysond payment forms for paystackPayment Forms for Paystack <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jgehrcke wp-geshi-highlight, unknown wp-geshi-highlight — rock-solid syntax highlighting for 259 languages +1 moreWP-GeSHi-Highlight <= 1.4.3 - Author+ ReDoS6.5 Medium
- feedify web push notifications, unknown feedify +1 moreFeedify – Web Push Notifications < 2.4.6 - Reflected XSS7.1 High
- octopus serverIn affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending...5.9 Medium
- brainstormforce ottokit: all-in-one automation platformSureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation8.1 High
- nababur simple-user-management-systemNababur Simple-User-Management-System register.php cross site scripting5.3 Medium
- dell powerscale onefsDell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an out-of-bounds write...3.1 Low
- dell powerscale onefsDell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an exposure of information...3.3 Low
- dell powerscale onefsDell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource...5.3 Medium
- Show moreLoading…