CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- surrealdbSurrealDB before 2.2.2 SSRF via HTTP Redirect Bypass5.8 Medium
- surrealdbSurrealDB before 2.2.2 CPU Exhaustion via nested FOR loops7.1 High
- surrealdbSurrealDB before 2.2.2 Denial of Service via JavaScript Scripting2.3 Low
- surrealdbSurrealDB before 2.2.2 Memory Exhaustion via string::replace7.1 High
- surrealdbSurrealDB before 2.2.2 SurrealQL Injection via export9.4 Critical
- verbb formieFormie has a XSS vulnerability for email notification content for preview4.6 Medium
- verbb formieFormie has a XSS vulnerability for importing forms5.3 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution5.4 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms <= 3.1.1 - Reflected Cross-Site Scripting6.1 Medium
- wpeverest everest forms, everest forms – contact form, payment form, quiz, survey & custom form builder +1 moreEverest Forms – Contact Form, Quiz, Survey, Newsletter & Payment Form Builder for WordPress <= 3.1.1 - Unauthenticated PHP Object Injection9.8 Critical
- sophos taegis endpoint agent (linux), taegis endpoint agent +1 moreA code injection vulnerability in the Debian package component of Taegis Endpoint Agent (Linux)...7.8 High
- wpzita z companionZ Companion <= 1.1.1 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- wedevs wp project manager, project manager – ai powered project management, task management, kanban board & time tracker +1 moreWP Project Manager <= 2.6.22 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload6.4 Medium
- open, inc. bizrobo!Deserialization of untrusted data issue exists in BizRobo! all versions. If this vulnerability is...8.8 High
- open, inc. bizrobo!Use of hard-coded cryptographic key issue exists in BizRobo! all versions. Credentials inside...3.7 Low
- stylemix cost calculator builderCost Calculator Builder <= 3.2.67 - Authenticated (Subscriber+) SQL Injection via order_ids Parameter6.5 Medium
- wp guru error log viewerWordPress Error Log Viewer By WP Guru plugin <= 1.0.5 - SQL Injection vulnerability8.5 High
- g5theme ultimate bootstrap elements for elementorWordPress Ultimate Bootstrap Elements for Elementor plugin <= 1.4.9 - Local File Inclusion Vulnerability8.1 High
- john weissberg print science designerWordPress Print Science Designer plugin <= 1.3.155 - Arbitrary File Download vulnerability7.5 High
- roninwp fat cooming soonWordPress FAT Cooming Soon plugin <= 1.1 - Local File Inclusion vulnerability8.1 High
- radiustheme testimonial slider and showcase proWordPress Testimonial Slider and Showcase Pro plugin <= 2.3.15 - Local File Inclusion vulnerability8.1 High
- stylemix motorsWordPress Motors plugin <= 1.4.71 - Local File Inclusion vulnerability8.1 High
- ability, inc accessibility suiteWordPress Accessibility Suite by Ability, Inc plugin <= 4.18 - SQL Injection vulnerability8.5 High
- neoslab database toolsetWordPress Database Toolset Plugin <= 1.8.4 - Arbitrary File Deletion vulnerability8.6 High
- kaizencoders automatic ban ipWordPress Automatic Ban IP Plugin <= 1.0.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- oxygensuite oxygen mydata for woocommerceWordPress Oxygen MyData for WooCommerce plugin <= 1.0.64 - Arbitrary File Deletion vulnerability8.6 High
- cmsjunkie - wordpress business directory plugins wp-businessdirectoryWordPress WP-BusinessDirectory Plugin <= 3.1.2 - Arbitrary File Deletion vulnerability8.6 High
- joomsky js job managerWordPress JS Job Manager plugin <= 2.0.2 - Local File Inclusion vulnerability8.1 High
- pickplugins wishlistWordPress Wishlist plugin <= 1.0.46 - SQL Injection vulnerability8.5 High
- ashan perera eventonWordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability8.8 High
- magepeopleteam wpbookinglyWordPress WpBookingly plugin <= 1.3.0 - PHP Object Injection vulnerability9.8 Critical
- hk wp online users statsWordPress WP Online Users Stats plugin <= 1.0.0 - SQL Injection vulnerability9.3 Critical
- twispay credit card paymentsWordPress Twispay Credit Card Payments Plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- tournamatchWordPress Tournamatch plugin <= 4.7.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- miunosoft task schedulerWordPress Task Scheduler Plugin <= 1.6.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wp table builder table builder, wptablebuilder wp table builder +1 moreWordPress WP Table Builder plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- odude flexi – guest submitWordPress Flexi – Guest Submit Plugin <= 4.28 - Local File Inclusion vulnerability8.1 High
- pickupp woocommerce pickuppWordPress WooCommerce Pickupp plugin <= 2.4.3 - Local File Inclusion vulnerability8.1 High
- aba bank payway payment gateway for woocommerceWordPress ABA PayWay Payment Gateway for WooCommerce Plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- trusty plugins shop products filterWordPress Shop Products Filter Plugin <= 1.2 - Local File Inclusion vulnerability7.5 High
- softclever limited sync postsWordPress Sync Posts Plugin <= 1.0 - Arbitrary File Upload vulnerability9.9 Critical
- hakeemnala build app onlineWordPress Build App Online Plugin <= 1.0.23 - Local File Inclusion vulnerability9.8 Critical
- realmag777 tableonWordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerability9.8 Critical
- empik empikplace for woocommerceWordPress EmpikPlace for Woocommerce Plugin <= 1.4.3 - PHP Object Injection vulnerability9.8 Critical
- dev02ali easy post duplicatorWordPress Easy Post Duplicator Plugin <= 1.0.1 - SQL Injection vulnerability8.5 High
- vertim neon product designerWordPress Neon Product Designer Plugin <= 2.2.0 - Unauthenticated SQL Injection vulnerability9.3 Critical
- ketanajani duplicate title checkerWordPress Duplicate Title Checker Plugin <= 1.2 - SQL Injection vulnerability8.5 High
- magnigenie restropressWordPress RestroPres plugin <= 3.2.8.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jaap jansma connector to civicrm with civimcrestfaceWordPress Connector to CiviCRM with CiviMcRestFace plugin <= 1.0.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- eazyplugins eazy plugin managerWordPress Eazy Plugin Manager plugin <= 4.3.0 - Broken Access Control vulnerability8.8 High
- Show moreLoading…