CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- wecantrack affiliate links liteWordPress Affiliate Links plugin <= 3.1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- weptile mobile app for woocommerceWordPress ShopApper plugin <= 0.4.61 - Cross Site Scripting (XSS) vulnerability7.1 High
- pickplugins question answerWordPress Question Answer plugin <= 1.2.73 - PHP Object Injection vulnerability8.8 High
- pickplugins question answerWordPress Question Answer plugin <= 1.2.70 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- projectopiaWordPress Projectopia plugin <= 5.1.24 - Privilege Escalation vulnerability9.8 Critical
- serpednet serped.netWordPress SERPed.net Plugin <= 4.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- gb-plugins gb gallery slideshowWordPress GB Gallery Slideshow Plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- lee blue cart66 cloudWordPress Cart66 Cloud Plugin <= 2.3.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- solacewp solace extraWordPress Solace Extra plugin <= 1.3.1 - Arbitrary File Upload vulnerability9.9 Critical
- devrix restrict user registrationWordPress Restrict User Registration plugin <= 1.0.1 - CSRF to Stored XSS vulnerability7.1 High
- joomsky js job managerWordPress JS Job Manager plugin <= 2.0.2 - Arbitrary File Upload vulnerability10.0 Critical
- wpwax helpgentWordPress HelpGent plugin <= 2.2.5 - PHP Object Injection vulnerability9.8 Critical
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - Deserialization of untrusted data vulnerability8.8 High
- hive support supportWordPress Hive Support plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- webbytemplate office locatorWordPress Office Locator plugin <= 1.3.0 - SQL Injection vulnerability9.3 Critical
- mark parnell spark gf failed submissionsWordPress Spark GF Failed Submissions plugin <= 1.3.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- romancode mapsvgWordPress MapSVG Lite plugin <= 8.6.4 - Arbitrary File Upload Vulnerability9.9 Critical
- wpfactory product excel import export & bulk edit for woocommerceWordPress Product Excel Import Export & Bulk Edit for WooCommerce plugin <= 4.7 - Cross Site Scripting (XSS) Vulnerability7.1 High
- rtpharry bulk page stub creatorWordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- spwebguy team membersWordPress Team Members plugin <= 3.4.4 - PHP Object Injection Vulnerability8.8 High
- ashish ajani contact form vcard generatorWordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bestweblayout rating by bestwebsoftWordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability8.8 High
- nicdark hotel bookingWordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability8.1 High
- spicethemes spice blocksWordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability7.5 High
- appsbd viteposWordPress Vitepos plugin <= 3.1.7 - Broken Authentication Vulnerability7.2 High
- starfish reviews review generation & marketingWordPress Starfish Review Generation & Marketing plugin <= 3.1.19 - Privilege Escalation vulnerability8.8 High
- shahjahan jewel fluentcommunityWordPress FluentCommunity plugin <= 1.2.15 - PHP Object Injection Vulnerability9.8 Critical
- jauhari xelion xelion webchatWordPress Xelion Webchat plugin <= 9.1.0 - Privilege Escalation Vulnerability8.8 High
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 1.47 - PHP Object Injection Vulnerability9.8 Critical
- crm perks perksWordPress CRM Perks plugin <= 1.1.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- elliot sowersby / relywp ai text to speechWordPress AI Text to Speech plugin <= 3.0.3 - Broken Access Control vulnerability6.5 Medium
- eivin landa bring fraktguiden for woocommerceWordPress Bring Fraktguiden for WooCommerce plugin <= 1.11.4 - Broken Access Control vulnerability6.5 Medium
- shamalli web directory freeWordPress Web Directory Free plugin <= 1.7.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- codepeople payment form for paypal proWordPress Payment Form for PayPal Pro plugin <= 1.1.72 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- taskbuilderWordPress Taskbuilder plugin <= 4.0.1 - SQL Injection Vulnerability8.5 High
- arture b.v. storecontrl woocommerceWordPress StoreContrl Woocommerce plugin <= 4.1.3 - Arbitrary File Download Vulnerability7.5 High
- jidaikobo dashiWordPress Dashi plugin <= 3.1.8 - Broken Access Control Vulnerability5.8 Medium
- metagauss profilegridWordPress ProfileGrid plugin <= 5.9.4.8 - SQL Injection Vulnerability8.5 High
- bertha ai – andrew palmer ai, berthaai bertha ai +1 moreWordPress BERTHA AI plugin <= 1.12.10.2 - Arbitrary Content Deletion Vulnerability7.1 High
- stylemix cost calculator builderWordPress Cost Calculator Builder plugin <= 3.2.65 - SQL Injection Vulnerability9.3 Critical
- bob arigato autoresponder and newsletterWordPress Arigato Autoresponder and Newsletter plugin <= 2.7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 2.4.0 - Deserialization of untrusted data Vulnerability9.8 Critical
- quentn.com gmbh quentn wpWordPress Quentn WP plugin <= 1.2.8 - SQL Injection Vulnerability9.3 Critical
- quentn.com gmbh quentn wpWordPress Quentn WP plugin <= 1.2.8 - Privilege Escalation Vulnerability9.8 Critical
- opentext secure content managerInsecure Dynamic-Link Library (DLL) Load vulnerability7.0 High
- think201 data dashWordPress Data Dash plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bill zimmerman vooplayer v4WordPress vooPlayer v4 Plugin <= 4.0.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wppluginboxdev stylish google sheet readerWordPress Stylish Google Sheet Reader plugin <= 4.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- vicente ruiz gálvez vr-frasesWordPress VR-Frases plugin <= 4.0.1 - Reflected XSS to SQL Injection vulnerability8.2 High
- caio web dev cwd – stealth linksWordPress CWD - Stealth Links plugin <= 1.3 - SQL Injection vulnerability9.3 Critical
- Show moreLoading…