CVEs published in April 2025
4,149 vulnerabilities, 323 critical, 16 exploited.
- hccoder paypal express checkoutWordPress PayPal Express Checkout plugin <= 2.1.2 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- navegg analyticsWordPress Navegg Analytics plugin <= 3.3.3 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- tomontoast drop capsWordPress Drop Caps plugin <= 2.1 - CSRF to XSS vulnerability6.5 Medium
- pham thanh call now pht blogWordPress Call Now PHT Blog plugin <= 2.4.1 - CSRF to XSS vulnerability7.1 High
- nasir179125 image hover effects for wpbakery page builderWordPress Image Hover Effects For WPBakery Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- padam shankhadev nepali post dateWordPress Nepali Post Date plugin <= 5.1.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- metaloha dropdown contentWordPress Dropdown Content plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability7.1 High
- nayon46 awesome wp image galleryWordPress Awesome Wp Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- webangon the pack elementor addonsWordPress The Pack Elementor addons plugin <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- peter raschendorfer smart hashtags [#hashtagger]WordPress Smart Hashtags [#hashtagger] plugin <= 7.2.3 - Broken Access Control Vulnerability4.3 Medium
- felixtz modern pollsWordPress Modern Polls plugin <= 1.0.10 - CSRF to Stored XSS vulnerability7.1 High
- john weissberg print science designerWordPress Print Science Designer plugin <= 1.3.155 - CSRF to Stored XSS vulnerability7.1 High
- trân minh-quân wpvnWordPress WPVN plugin <= 0.7.8 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- olav kolbu google newsWordPress Google News plugin <= 2.5.1 - CSRF to Stored XSS vulnerability7.1 High
- x000x occupancyplanWordPress occupancyplan plugin <= 1.0.3.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- adam pery animateWordPress Animate plugin <= 0.5 - Server Side Request Forgery (SSRF) Vulnerability4.9 Medium
- sebastian echeverry scss-libraryWordPress SCSS-Library plugin <= 0.4.1 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- vladimir prelovac plugin centralWordPress Plugin Central plugin <= 2.5.1 - CSRF to Arbitrary File Deletion vulnerability7.4 High
- yash binani time based greetingWordPress Time Based Greeting plugin <= 2.2.2 - CSRF to Stored XSS vulnerability7.1 High
- wpoperation arrivalWordPress Arrival theme <= 1.4.5 - Local File Inclusion vulnerability7.5 High
- everestthemes grace magWordPress Grace Mag theme <= 1.1.5 - Local File Inclusion vulnerability7.5 High
- code work web cww portfolioWordPress CWW Portfolio theme <= 1.3.1 - Local File Inclusion vulnerability7.5 High
- holest engineering spreadsheet price changer for woocommerce and wp e-commerce – lightWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Local File Inclusion vulnerability7.5 High
- wedevs appsero helperWordPress Appsero Helper plugin <= 1.3.4 - SQL Injection vulnerability8.5 High
- kiotviet syncWordPress KiotViet Sync plugin <= 1.8.4 - CSRF to Stored XSS vulnerability7.1 High
- capturlyWordPress Capturly plugin <= 2.0.1 - Local File Inclusion vulnerability7.5 High
- danielpataki acf: google font selectorWordPress ACF: Google Font Selector plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- cedcommerce product lister for ebayWordPress Product Lister for eBay plugin <= 2.0.9 - Local File Inclusion vulnerability7.5 High
- code work web xews liteWordPress Xews Lite plugin <= 1.0.9 - Local File Inclusion vulnerability7.5 High
- wpoperation opstoreWordPress Opstore theme <= 1.4.5 - Local File Inclusion vulnerability7.5 High
- vowelweb siratWordPress Sirat theme <= 1.5.1 - Broken Access Control vulnerability4.3 Medium
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.3.6 - Broken Access Control vulnerability5.3 Medium
- gopiplus@hotmail.com anything popupWordPress Anything Popup plugin <= 7.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- zamartz checkout field visibility for woocommerceWordPress Checkout Field Visibility for WooCommerce plugin <= 1.3.0 - Local File Inclusion vulnerability7.5 High
- wpeverest user registration, user registration \& membership +1 moreWordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ashraful sarkar naiem license for envatoWordPress License For Envato plugin <= 1.0.0 - Local File Inclusion vulnerability7.5 High
- heateor support sassy social shareWordPress Sassy Social Share plugin <= 3.3.73 - Open Redirection vulnerability4.7 Medium
- blubrry powerpress podcastingWordPress PowerPress Podcasting <= 11.12.5 - Arbitrary File Upload Vulnerability9.9 Critical
- everpress bruteguard – brute force login protectionWordPress BruteGuard – Brute Force Login Protection plugin <= 0.1.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- habibur rahman razib control listingsWordPress Control Listings plugin <= 1.0.4.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- ghozylab popup builderWordPress Popup Builder plugin <= 1.1.35 - Local File Inclusion Vulnerability7.5 High
- wowdevs sky addons for elementorWordPress Sky Addons for Elementor plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- m a vinoth kumar frontend dashboardWordPress Frontend Dashboard plugin <= 2.2.5 - SQL Injection Vulnerability9.3 Critical
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.9.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- python-hyper h11h11 accepts some malformed Chunked-Encoding bodies9.1 Critical
- trpctRPC 11 WebSocket DoS Vulnerability8.7 High
- acronis cyber protect 17, cyber protect cloud agent +1 moreDenial of service due to allocation of resources without limits. The following products are...5.5 Medium
- acronis cyber protect 16, cyber protect cloud agent +1 moreLocal privilege escalation due to insecure folder permissions. The following products are...6.7 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +13 more +15 moreLibsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server6.8 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +13 more +15 moreLibsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c6.5 Medium
- Show moreLoading…