CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- tecnick tcexamTecnick - Multiple XSS (CWE-79)6.1 Medium
- checkmkRemote site authentication secrets written to web log7.1 High
- oceanwp ocean extraOcean Extra <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution6.5 Medium
- oceanwp ocean extraOcean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ocean_gallery_id'6.4 Medium
- caseproof memberpressMemberpress <= 1.11.37 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure5.3 Medium
- oceanwp ocean extraOcean Extra <= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
govulncheck-vulndbopenSUSESecurity update for govulncheck-vulndbNo score- visual composer website builder, visualcomposer visual composer website builder +1 moreWordPress Visual Composer Website Builder plugin <= 45.10.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ataur r gutenkitWordPress GutenKit plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- kofi mokome message filter for contact form 7WordPress Message Filter for Contact Form 7 plugin <= 1.6.3.2 - SQL Injection vulnerability7.6 High
- e4jconnect vikrestaurants table reservations and take-away, e4jvikwp vikrestaurants +1 moreWordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.3.3 - CSRF to Stored XSS vulnerability7.1 High
- vikas ratudi vpsuform, vikasratudi lifetime free drag \& drop contact form builder +1 moreWordPress VForm plugin <= 3.1.14 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- michael simple calendar for elementorWordPress Simple calendar for Elementor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- codepeople appointment booking calendarWordPress Appointment Booking Calendar plugin <= 1.3.92 - Broken Access Control Vulnerability5.3 Medium
- cminds cm answersWordPress CM Answers plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- cminds cm ad changerWordPress CM Ad Changer plugin <= 2.0.5 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- dotstore advanced linked variations for woocommerceWordPress Advanced Linked Variations for Woocommerce plugin <= 1.0.3 - Broken Access Control Vulnerability5.3 Medium
- sktthemes recover abandoned cart for woocommerceWordPress Recover abandoned cart for WooCommerce plugin <= 2.2 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- bob watu quizWordPress Watu Quiz plugin <= 3.4.3 - SQL Injection Vulnerability7.6 High
- codepeople appointment booking calendarWordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability8.2 High
- jeff starr simple download counterWordPress Simple Download Counter plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- jeff starr theme switchaWordPress Theme Switcha plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- rbaer list last changesWordPress List Last Changes plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- yannick lefebvre link libraryWordPress Link Library plugin <= 7.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- link software llc html formsWordPress HTML Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- sktthemes skt blocksWordPress SKT Blocks – Gutenberg based Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- sirvWordPress Sirv plugin <= 7.5.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- alttext alt text ai, alttextai download alt text ai +1 moreWordPress Download Alt Text AI plugin <= 1.9.93 - Broken Access Control Vulnerability4.3 Medium
- servit affiliate-toolkitWordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability5.4 Medium
- israpil textmetricsWordPress Textmetrics plugin <= 3.6.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- avecnous event postWordPress Event post plugin <= 5.9.11 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- brecht custom related postsWordPress Custom Related Posts plugin <= 1.7.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- ferranfg mpl-publisherWordPress MPL-Publisher plugin <= 2.18.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- michael post in page for elementorWordPress Post in page for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- unblu inc. sparkReplace uploaded files knowing the file upload ID7.0 High
- unblu sparkFile upload functionality possible even when disabled5.3 Medium
- apache kvrocksApache Kvrocks: The server was crashed by the negative offset7.5 High
- unknown user registration & membership, wpeverest user registration \& membership +1 moreUser Registration & Membership < 4.1.3 - Authentication Bypass8.1 High
- etoilewebdesign front end usersFront End Users <= 3.2.32 - Reflected XSS7.1 High
- wijnbergdevelopments tax switch for woocommerceTax Switch for WooCommerce <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via class-name Parameter6.4 Medium
- vjinfotech wp import export liteWP Import Export Lite <= 3.9.27 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting6.4 Medium
- wpsoul greenshift – animation and page builder blocks, greenshiftwp greenshift - animation and page builder blocks +1 moreGreenshift 11.4 - 11.4.5 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- hitachi ops center analyzer viewpoint ovf, ops center common services +1 moreAuthentication credentials leakage vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center Analyzer viewpoint OVF7.1 High
- hitachi ops center common servicesInformation exposure vulnerability in Hitachi Ops Center Common Services within Hitachi Ops Center OVA5.5 Medium
- zyxel amg1302-t10b firmware**UNSUPPORTED WHEN ASSIGNED** A path traversal vulnerability in the web management interface of...4.9 Medium
- zyxel uos, usg flex h series uos firmware +1 moreAn improper privilege management vulnerability in the recovery function of the USG FLEX H series...6.7 Medium
- zyxel uos, usg flex h series uos firmware +1 moreAn incorrect permission assignment vulnerability in the PostgreSQL commands of the USG FLEX H...7.8 High
- 201206030 novel-plusxxyopen Novel-Plus searchByPage sql injection5.3 Medium
- codecanyon rise ultimate project managerCodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection5.3 Medium
- h3c gr-3000axH3C GR-3000AX HTTP POST Request aspForm Edit_List_SSID buffer overflow8.6 High
- Show moreLoading…