CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- rachanas sponsered linkWordPress Sponsered Link plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- studio hyperset the great firewords of chinaWordPress The Great Firewords of China plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crudlab scroll to topWordPress CRUDLab Scroll to Top Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- platcom wp-asambleasWordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- webbernaut cloak front end emailWordPress Cloak Front End Email <= 1.9.5 - Broken Access Control Vulnerability7.5 High
- jayesh parejiya social media linksWordPress Social Media Links plugin <= 1.0.3 - CSRF to Stored XSS vulnerability7.1 High
- mike spam-stopperWordPress spam-stopper plugin <= 3.1.3 - CSRF to Stored XSS vulnerability7.1 High
- ichi translit it!WordPress translit it! plugin <= 1.6 - CSRF to Stored XSS vulnerability7.1 High
- eslam mahmoud redirect wordpress to welcome or landing pageWordPress Redirect wordpress to welcome or landing page plugin <= 2.0 - CSRF to Stored XSS vulnerability7.1 High
- ajayver rss managerWordPress RSS Manager plugin <= 0.06 - CSRF to Stored XSS vulnerability7.1 High
- david miller revision dietWordPress Revision Diet plugin <= 1.0.1 - CSRF to Stored XSS vulnerability7.1 High
- ruudkok wp twitter buttonWordPress WP Twitter Button plugin <= 1.4.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- presponsive wp social bookmarkingWordPress WP Social Bookmarking plugin <= 3.6 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- mustafa kucuk wp sticky side buttonsWordPress WP Sticky Side Buttons plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- jenst add to headerWordPress Add to Header plugin <= 1.0 - CSRF to XSS vulnerability7.1 High
- simplemaps simple mapsWordPress Simple Maps plugin <= 0.98 - CSRF to XSS vulnerability7.1 High
- pixelgrade style managerWordPress Style Manager plugin <= 2.2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability4.3 Medium
- illow – cookies consentWordPress illow – Cookies Consent plugin <= 0.2.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- beth tucker long wp post to pdf enhancedWordPress WP Post to PDF Enhanced plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- földesi, mihály széchenyi 2020 logoWordPress Széchenyi 2020 Logo <= 1.1 - Local File Inclusion vulnerability7.5 High
- maros pristas gravity forms css themes with fontawesome and placeholdersWordPress Gravity Forms CSS Themes with Fontawesome and Placeholders plugin <= 8.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- alexander rauscha mlanguageWordPress mLanguage plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- aaron forgue amazon showcase wordpress pluginWordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerability7.1 High
- antonchanning bbpress2 shortcode whitelistWordPress bbPress2 shortcode whitelist plugin <= 2.2.1 - CSRF to XSS vulnerability7.1 High
- beke ro bknewstickerWordPress Bknewsticker plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- davidfcarr my marginaliaWordPress My Marginalia plugin <= 1.0.6 - CSRF to Stored XSS vulnerability7.1 High
- scott taylor avatarWordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability4.3 Medium
- aidraw i drawWordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability9.1 Critical
- boone gorges anthologizeWordPress Anthologize plugin <= 0.8.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- momen2009 theme changerWordPress Theme Changer plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- markus drubba wplike2getWordPress wpLike2Get plugin <= 1.2.9 - Sensitive Data Exposure vulnerability5.3 Medium
- rajesh broken links removerWordPress Broken Links Remover plugin <= 1.2.2 - CSRF to Stored XSS vulnerability7.1 High
- swedish boy dashboard notepadsWordPress Dashboard Notepads plugin <= 1.2.1 - CSRF to Stored XSS vulnerability7.1 High
- messagemetric review wave – google places reviewsWordPress Review Wave – Google Places Reviews plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- maxfoundry maxbuttonsWordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- soft8soft llc verge3dWordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- arraytics wpcafeWordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability7.5 High
- algol.plus advanced dynamic pricing for woocommerceWordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.9.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability4.3 Medium
- itron wp loggerWordPress WP Logger plugin <= 2.2 - Broken Access Control vulnerability5.4 Medium
- ip2location variablesWordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability7.1 High
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.2.8 - Broken Access Control vulnerability5.3 Medium
- nawawi jamili docket cacheWordPress Docket Cache plugin <= 24.07.02 - Local File Inclusion vulnerability7.5 High
- teamzt smart agreementsWordPress Smart Agreements plugin <= 1.0.3 - Local File Inclusion vulnerability7.5 High
- rtowebsites adminquickbarWordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- omnissa unified access gateway (uag), unified access gateway +1 moreOmnissa UAG contains a Cross-Origin Resource Sharing (CORS) bypass vulnerability. A malicious...7.1 High
- imanage work desktop for macCommand Injection in iManage Work Desktop for Mac's Agent Service9.3 Critical
- opentext™ operations bridge manager, operations bridge suite (containerized), ucmdb ( classic and containerized) +2 moreIncorrect Use of Privileged vulnerability has been discovered on OpenText™ UCMDB and Operation Bridge Manager product.8.7 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Cross-site Scripting vulnerability4.8 Medium
libsoupTuxCare,libsoup-develTuxCare +1 moreUpdate of libsoupNo score- dell ecs, elastic cloud storage, objectscale +2 moreDell ECS version 3.8.1.4 and prior contain an Improper Input Validation vulnerability. A low...4.3 Medium
- Show moreLoading…