CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- notfound wpjobboardWordPress WPJobBoard plugin < 5.11.1 - Path Traversal vulnerability5.4 Medium
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.2.8 - Local File Inclusion vulnerability7.5 High
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- notfound unlimited timelineWordPress Unlimited Timeline < 1.6.1 - Broken Access Control Vulnerability7.5 High
- sktthemes skt blocksWordPress SKT Blocks – Gutenberg based Page Builder plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- fetch designs sign-up sheetsWordPress Sign-up Sheets plugin <= 2.3.0.1 - Shortcode Injection vulnerability6.5 Medium
- crocoblock jetmenuWordPress JetMenu plugin <= 2.4.9 - Broken Access Control Vulnerability7.5 High
- covertnine c9 blocksWordPress C9 Blocks plugin <= 1.7.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- addonspress nepali date converterWordPress Nepali Date Converter plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- graphthemes glossy blogWordPress Glossy Blog theme <= 1.0.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- alleythemes home servicesWordPress Home Services plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- epc ai hubWordPress AI Hub plugin <= 1.3.7 - Arbitrary File Upload vulnerability10.0 Critical
- tainacan taináWordPress Tainá plugin <= 0.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- gurmehub kargo entegratörWordPress Kargo Entegratör plugin <= 1.1.14 - SQL Injection vulnerability7.6 High
- ren ventura wp delete user accountsWordPress WP Delete User Accounts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- realmag777 inpost galleryWordPress InPost Gallery plugin <= 2.1.4.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- sonalsinha21 skt skill barWordPress SKT Skill Bar plugin <= 2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.6.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpfactory additional custom product tabs for woocommerceWordPress Additional Custom Product Tabs for WooCommerce plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- loos,inc. arkheWordPress Arkhe theme <= 3.12.0 - CSRF to Local File Inclusion vulnerability8.1 High
- caalami advanced custom fields: link picker fieldWordPress Advanced Custom Fields: Link Picker Field plugin <= 1.2.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- burgersoftware spabizWordPress SpaBiz plugin <= 1.0.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- notfound macro calculator with admin email optin & dataWordPress Macro Calculator with Admin Email Optin & Data plugin <= 1.0 - Multiple Vulnerabilities vulnerability7.5 High
- shapedplugin llc real testimonialsWordPress Real Testimonials plugin <= 3.1.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- uncanny owl toolkit for learndashWordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- lcweb global galleryWordPress Global Gallery plugin <= 8.8.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal External Control of System or Configuration Setting6.9 Medium
- nats-io nats-serverNATS-Server Fails to Authorize Certain Jetstream Admin APIs9.6 Critical
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Cross-site Scripting9.3 Critical
- growatt cloud portalGrowatt Cloud portal Insufficient Type Distinction9.3 Critical
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
vllmPyPIvLLM vulnerable to Denial of Service by abusing xgrammar cache6.5 Medium- kyvernoKyverno before v1.13.4 SSRF via Service Call6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- autodesk revit, advance steel, autocad +8 more +10 moreRCS File Parsing Out-of-Bounds Write Vulnerability7.8 High
- autodesk advance steel, autocad, autocad architecture +8 more +10 morePDF File Parsing Memory Corruption Vulnerability7.8 High
- growatt cloud portalGrowatt Cloud portal Authorization Bypass Through User-Controlled Key6.9 Medium
- Show moreLoading…