CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- cyberchimps responsive blocksWordPress Responsive Blocks plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- themifyme themify shortcodesWordPress Themify Shortcodes plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.36 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- themefic travelfic toolkitWordPress Travelfic Toolkit plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- arraytics eventinWordPress Eventin plugin <= 4.0.25 - Local File Inclusion Vulnerability7.5 High
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.1.9 - Sensitive Data Exposure Vulnerability4.3 Medium
- wp shuffle subscription formsWordPress WP Subscription Forms plugin <= 1.2.3 - Broken Access Control Vulnerability5.4 Medium
- wpdeveloper essential addons for elementorWordPress Essential Addons for Elementor plugin <= 6.1.9 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- everaccounting ever accountingWordPress Ever Accounting plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- wp shuffle subscribe to unlock liteWordPress Subscribe to Unlock Lite plugin <= 1.3.0 - Local File Inclusion Vulnerability7.5 High
- arthur yarwood fast ebay listingsWordPress Fast eBay Listings plugin <= 2.12.15 - Open Redirection Vulnerability4.7 Medium
- quý lê 91 administrator zWordPress Administrator Z plugin <= 2025.03.28 - Directory Traversal Vulnerability4.9 Medium
- crm perks integration for woocommerce and quickbooksWordPress Integration for WooCommerce and QuickBooks plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- webilia inc. listdomWordPress Listdom plugin <= 4.0.0 - Open Redirection Vulnerability4.7 Medium
- wpfactory custom css, js & phpWordPress Custom CSS, JS & PHP plugin <= 2.4.1 - CSRF to RCE vulnerability9.6 Critical
- wc product table woocommerce product table liteWordPress WooCommerce Product Table Lite plugin <= 3.9.5 - Broken Access Control vulnerability4.3 Medium
- symfonia ready Stored Cross-Site Scripting in Ready_5.1 Medium
- symfonia ready Local File Inclusion in Ready_7.1 High
- symfonia ready SQL Injection in Ready_9.4 Critical
- symfonia ready Remote Code Execution via Unrestricted File Upload in Ready_7.1 High
- phpgurukul men salon management systemPHPGurukul Men Salon Management System edit-customer-detailed.php sql injection6.9 Medium
- mirweiye seven bears library cmsmirweiye Seven Bears Library CMS Background Management Page cross site scripting4.8 Medium
- misstt123 oasysmisstt123 oasys Sticky Notes cross-site request forgery5.3 Medium
- misstt123 oasysmisstt123 oasys show image path traversal5.3 Medium
- code-projects patient record management systemcode-projects Patient Record Management System edit_fpatient.php sql injection5.3 Medium
- xianqi kindergarten management systemXianqi Kindergarten Management System Child Management stu_list.php sql injection5.3 Medium
- pcman ftp serverPCMan FTP Server SIZE Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server PASV Command buffer overflow6.9 Medium
- linux, linux kernel +1 morenfsd: fix legacy client tracking initialization5.5 Medium
- fs-code fs posterWordPress FS Poster plugin <= 6.5.8 - Subscriber+ Site Wide Broken Access Control vulnerability8.3 High
- linux, linux kernel +1 moreusb: xhci: Don't skip on Stopped - Length Invalid7.8 High
- linux, linux kernel +1 moreusb: xhci: Apply the link chain quirk on NEC isoc endpoints7.8 High
- linux, linux kernel +1 morenetfilter: socket: Lookup orig tuple for IPv6 SNAT10.0 Critical
- linux, linux kernel +1 morememstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove7.8 High
- linux, linux kernel +1 morebcachefs: bch2_ioctl_subvolume_destroy() fixes7.3 High
- pcman ftp serverPCMan FTP Server MODE Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server LANG Command buffer overflow6.9 Medium
- pcman ftp serverPCMan FTP Server HOST Command buffer overflow6.9 Medium
- mattermost, mattermost server, ms teams +2 moreWebhook Secret Exposure via Timing attack in MSteams plugin5.3 Medium
- mattermost, mattermost server +1 moreData exfiltration via AI plugin Jira tool3.0 Low
- pcman ftp serverPCMan FTP Server HELP Command buffer overflow6.9 Medium
- lm-sys fastchatlm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization4.8 Medium
- unknown wp staging pro wordpress backup pluginWP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function5.3 Medium
- suse manager server module 4.3, container suse/manager/5.0/x86 64/server:5.0.4.7.19.1 +1 moreReflected XSS in SystemsController.java in spacewalk-java5.6 Medium
- 201206030 novel-plusxxyopen Novel-Plus books sql injection5.3 Medium
- mattermost, mattermost server +1 moreChannel metadata visible in archived channels despite configuration setting4.3 Medium
- mattermost, mattermost server +1 moreMFA Enforcement Bypass Allows Unauthorized Removal of MFA for Other Users2.2 Low
- mattermost, mattermost server +1 moreUnauthorized AI bot activation via Wrangler plugin3.1 Low
- muffingroup bethemeBetheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wago cc100 0751-9x01, pfc100 g1 0750-810x/xxxx-xxxx, pfc100 g2 0750-811x-xxxx-xxxx +9 more +11 moreWAGO: Year 2038 problem6.5 Medium
- Show moreLoading…