CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- infosoftplugin woocommerce sales mis reportWordPress WooCommerce Sales MIS Report Plugin <= 4.0.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- josh kohlbach store exporterWordPress WooCommerce – Store Exporter plugin <= 2.7.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- dev02ali easy post duplicatorWordPress Easy Post Duplicator Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rachel cherry lock your updatesWordPress Lock Your Updates Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- sandeep verma html5 video player with playlistWordPress HTML5 Video Player with Playlist Plugin <= 2.50 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- workbox video from vimeo & youtubeWordPress Workbox Video from Vimeo & Youtube Plugin Plugin <= 3.2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- interactivegeomaps interactive geo mapsWordPress Interactive Geo Maps plugin <= 1.6.24 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- myworks woocommerce sync for quickbooks onlineWordPress MyWorks WooCommerce Sync for QuickBooks Online plugin <= 2.9.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- payphone woocommerce – payphone gatewayWordPress WooCommerce – Payphone Gateway plugin <= 3.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- foysal imran idonateWordPress IDonate plugin <= 2.1.18 - Local File Inclusion vulnerability8.1 High
- scand multimailerWordPress MultiMailer plugin <= 1.0.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpminds simple wp eventsWordPress Simple WP Events plugin <= 1.8.17 - Arbitrary File Deletion vulnerability7.5 High
- rankology seo – on-site seoWordPress Rankology SEO – On-site SEO plugin <= 2.2.4 - Privilege Escalation Vulnerability9.8 Critical
- pickplugins job board managerWordPress Job Board Manager Plugin <= 2.1.61 - PHP Object Injection vulnerability8.8 High
- pickplugins accordionWordPress Accordion plugin <= 2.3.11 - PHP Object Injection vulnerability8.8 High
- n-media bulk product syncWordPress Bulk Product Sync plugin <= 8.6 - SQL Injection vulnerability9.3 Critical
- lisandro martinez wpsmartcontractsWordPress WPSmartContracts plugin <= 2.0.12 - SQL Injection vulnerability9.3 Critical
- programphases insert html hereWordPress Insert HTML Here plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- danbwb oppso unit converterWordPress Oppso Unit Converter plugin <= 1.1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- anytrack affiliate link managerWordPress AnyTrack Affiliate Link Manager plugin <= 1.0.4 - Broken Access Control Vulnerability7.5 High
- exthemes wp food ordering and restaurant menuWordPress WP Food ordering and Restaurant Menu plugin <= 2.7 - Local File Inclusion vulnerability8.1 High
- huseyin berberoglu wp hide categoriesWordPress WP Hide Categories plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability7.1 High
- dolby uk mobile smartWordPress Mobile Smart plugin <= v1.3.16 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- adrian tobey wordpress smtp service, email delivery solved! — mailhawkWordPress SMTP Service, Email Delivery Solved! — MailHawk plugin <= 1.3.1 - Local File Inclusion Vulnerability7.5 High
- hossein material dashboardWordPress Material Dashboard plugin <= 1.4.5 - Local File Inclusion Vulnerability7.5 High
gnutlsTuxCare,gnutls-c++TuxCare,gnutls-daneTuxCare +2 more +4 moreUpdate of gnutlsNo score- yaycommerce smtp for amazon ses – yaysmtpSMTP for Amazon SES – YaySMTP <= 1.8 - Unauthenticated Stored Cross-Site Scripting via Email Logs7.2 High
- tp-link corporation limited deco be65 proOS command injection vulnerability exists in Deco BE65 Pro firmware versions prior to "Deco BE65...8.0 High
- qtBuffer overflow in QTextMarkdownImporter4.8 Medium
- ch-go, clickhouse ch +1 moreQuery smuggling in ch-go library5.9 Medium
- instawp connect – 1-click wp staging & migrationInstaWP Connect <= 0.1.0.85 - Unauthenticated Local PHP File Inclusion8.1 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted Packet8.7 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Authenticated Admin Command Injection Vulnerability in PAN-OS VM-Series7.1 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Session Fixation Vulnerability in GlobalProtect SAML Login8.3 High
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Improper Neutralization of Input in the Management Web Interface6.9 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +2 morePAN-OS: Authenticated File Deletion Vulnerability on the Management Web Interface5.1 Medium
- palo alto networks prisma sd-wanPrisma SD-WAN: Denial of Service (DoS) Vulnerability Through Burst of Crafted Packets5.1 Medium
- palo alto networks cortex xdr agentCortex XDR Agent: Local Windows User Can Crash the Agent6.8 Medium
- palo alto networks globalprotect app, paloaltonetworks globalprotect, palo alto networks globalprotect uwp app +2 moreGlobalProtect App: Local Privilege Escalation (PE) Vulnerability7.1 High
- dell powerprotect cyber recoveryDell PowerProtect Cyber Recovery, versions prior to 19.18.0.2, contains an Insertion of Sensitive...5.8 Medium
- ibm qradar wincollect agent, qradar wincollect +1 moreIBM QRadar WinCollect Agent denial of service4.3 Medium
suricataOSS-FuzzUse-of-uninitialized-value in luaS_newNo score- codelit courselitCodeLit CourseLit before 0.57.5 allows Parameter Tampering via a payment plan associated with the...3.1 Low
- w. w. norton inquizitiveW. W. Norton InQuizitive through 2025-04-08 allows students to conduct stored XSS attacks against...6.4 Medium
- w. w. norton inquizitiveW. W. Norton InQuizitive through 2025-04-08 allows students to insert arbitrary records of their...7.7 High
- oz forensics face recognition applicationThe Oz Forensics face recognition application before 4.0.8 late 2023 allows PII retrieval via ...8.6 High
- surrealdbSurrealDB before 2.2.2 Local File Read via DEFINE ANALYZER2.3 Low
- surrealdbSurrealDB before 2.2.2 Memory Exhaustion via Nested Functions6.0 Medium
- surrealdbSurrealDB before 2.2.2 Denial of Service via /sql endpoint7.1 High
- oisf suricataSuricata decode_base64: signature can do large memory allocation6.2 Medium
- Show moreLoading…