CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- takien clipartClipArt <= 0.2 - Reflected XSS6.1 Medium
- smartdatasoft clasify classified listingClasify Classified Listing <= 1.0.7 - Reflected XSS6.1 Medium
- codeflock wp deskliteWP DeskLite <= 1.0.0 - Reflected XSS6.1 Medium
- mohsinrasool twitter bootstrap collapse aka accordian shortcodeTwitter Bootstrap Collapse aka Accordian Shortcode <= 1.0 - Stored XSS via Shortcode5.4 Medium
- unknown simple basic contact formSimple Basic Contact Form < 20250114 - Admin+ Stored XSS4.8 Medium
- unknown prisna gwt, prisna google website translator +1 morePrisna GWT < 1.4.14 - Admin+ Stored XSS4.8 Medium
- unknown prisna gwt, prisna google website translator +1 morePrisna GWT < 1.4.14 - Admin+ Stored XSS4.8 Medium
- joomlaserviceprovider jsp store locatorJSP Store Locator <= 1.0 - Deletion via Missing CSRF6.5 Medium
- unknown wordpress连接微博, smyx wp-connect +1 moreWordPress连接微博 <= 2.5.6 - Stored XSS via CSRF6.1 Medium
- projectpanorama panoramaPanorama – WordPress Project Management Plugin <= 1.5.1 - Admin+ Stored XSS4.8 Medium
- couleurcitron tarteaucitron-wptarteaucitron.js for WordPress < 0.3.0 - Stored XSS via CSRF6.1 Medium
- couleurcitron tarteaucitron-wptarteaucitron.js for WordPress < 0.3.0 - Author+ Stored XSS5.4 Medium
- unknown planning center online givingPlanning Center Online Giving <= 1.0.0 - Contributor+ XSS via Shortcode5.4 Medium
- floriansimunek connexion logsConnexion Logs <= 3.0.2 - Log Deletion via CSRF4.3 Medium
- floriansimunek connexion logsConnexion Logs <= 3.0.2 - Admin+ SQL Injection7.2 High
- mitchelllevy ahathat, unknown ahathat plugin +1 moreAHAthat Plugin <= 1.6 - Admin+ SQL Injection7.2 High
- joomlaserviceprovider jsp store locatorJSP Store Locator <= 1.0 - Contributor+ SQL Injection8.8 High
- pixeljar geocache stat bar widgetGeocache Stat Bar Widget <= 0.911 - Admin+ Stored XSS4.8 Medium
- unknown full screen (page) background image slideshow, mohsinrasool full screen \(page\) background image slideshow +1 moreFull Screen (Page) Background Image Slideshow <= 1.1 - Admin+ Stored XSS4.8 Medium
- jidaikobo jwp-a11yjwp-a11y <= 4.1.7 - Admin+ Stored XSS4.8 Medium
- reputeinfosystems social share and social lockerSocial Share And Social Locker – ARSocial < 1.4.2 - Admin+ Stored XSS4.8 Medium
- jontasc sailthru triggermailSailthru Triggermail < 1.1 - Subscriber+ Stored XSS6.1 Medium
- unknown real wp shop lite ajax ecommerce shopping cartReal WP Shop Lite Ajax eCommerce Shopping Cart <= 2.0.8 - Admin+ Stored XSS3.5 Low
- jgwhite33 wp google review sliderWP Google Review Slider < 15.6 - Admin+ Stored XSS4.8 Medium
- unknown jsfiddle shortcodeJSFiddle Shortcode < 1.1.3 - Contributor+ XSS via Shortcode5.4 Medium
- unknown btev, bluetrait blue trait event viewer +1 moreBTEV <= 2.0.2 - Settings Update via CSRF4.3 Medium
- klarned auto prune postsAuto Prune Posts < 3.0.0- Admin+ Stored XSS4.8 Medium
- nokautpl nokaut offers boxNokaut Offers Box <= 1.4.0 - Plugin Reset via CSRF4.3 Medium
- nokautpl nokaut offers boxNokaut Offers Box <= 1.4.0 - Admin+ Stored XSS4.8 Medium
- flickdevs countdown timer for wordpress block editorCountdown Timer <= 1.0.5 - Contributor+ Stored XSS6.5 Medium
- reputeinfosystems arforms, unknown contact form, survey, quiz & popup form builder +1 moreARForms Builder < 1.7.1 - Unauthenticated Stored XSS5.4 Medium
- unknown responsive contact form builder & lead generation plugin, themehunk contact form \& lead form elementor builder +1 moreLead Form Builder < 1.9.8 - Admin+ Stored XSS4.8 Medium
- unknown social media share buttons & social sharing icons, inisev social media share buttons \& social sharing icons +1 moreSocial Media Share Buttons < 2.9.0 - Admin+ Stored XSS4.8 Medium
- unknown social slider feed, cm-wp social slider widget +1 moreSocial Slider Feed < 2.2.9 - Admin+ Stored XSS via Widgets4.8 Medium
- nerdpress hubbub lite, devpups social pug +1 moreHubbub Lite < 1.34.4 - Admin+ Stored XSS4.8 Medium
- unknown photo gallery, images, slider in rbs image gallery, robosoft robo gallery +1 morePhoto Gallery, Images, Slider in Rbs Image Gallery < 3.2.22 - Contributor+ Stored XSS4.8 Medium
- unknown mb custom post types & custom taxonomies, deluxeblogtips mb custom post types \& custom taxonomies +1 moreMB Custom Post Types & Custom Taxonomies < 2.7.7 - Admin+ Stored XSS4.8 Medium
- seedprod rafflepress, syed balkhi giveaways and contests by rafflepress +1 moreGiveaways and Contests by RafflePress < 1.12.17 - Admin+ Stored XSS4.8 Medium
- unknown applyonline, spiderteams applyonline - application form builder and manager +1 moreApplyOnline – Application Form Builder and Manager < 2.6.3 - Unauthenticated Application File Access2.7 Low
- automattic jetpack, jetpack boost +1 moreJetpack < 13.8, Boost < 3.4.8 - Contributor+ Stored XSS5.9 Medium
- automattic jetpackJetpack < 13.8 - Unauthenticated Arbitrary Block & Shortcode Execution5.6 Medium
- happyformsHappyforms < 1.26.3 - Admin+ Stored XSS4.8 Medium
- melapress file monitor, unknown melapress file monitor +1 moreWebsite File Changes < 2.1.0 - Admin+ Authenticated SQL Injection4.1 Medium
- phpgurukul company visitor management systemPHPGurukul Company Visitor Management System visitors-form.php sql injection6.9 Medium
- horillaHorilla Open Redirect Vulnerability in Login6.1 Medium
- atheosMissing Path Validation Enables Path Traversal in Controller.php9.4 Critical
- alchemyplatform modular-accountAlchemy's Modular Account can use executeUserOp to bypass allowlist prevalidation hook6.6 Medium
- emlogEmlog vulnerable to Stored Cross-site Scripting1.9 Low
- campcodes sales and inventory systemCampcodes Sales and Inventory System credit_transaction_add.php sql injection6.9 Medium
- campcodes sales and inventory systemCampcodes Sales and Inventory System view_application.php sql injection6.9 Medium
- Show moreLoading…