CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- unknown offload videosOffload Videos – Bunny.net, AWS S3 <= 1.0.1 Subscriber+ CSRF8.1 High
- freebiesdownload pvn auth popupPVN Auth Popup <= 1.0.0 - Contributor+ XSS via Shortcode5.4 Medium
- freebiesdownload pvn auth popupPVN Auth Popup <= 1.0.0 - Admin+ Stored XSS4.8 Medium
- acugis mapfig studioMapFig Studio <= 0.2.1 - Stored XSS via CSRF6.1 Medium
- cozmoslabs profile builder, unknown user profile builder +1 moreProfile Builder <= 3.12.0 - Admin+ Stored Cross Site Scripting4.8 Medium
- unknown wccp-pro, wp-buy wp content copy protection \& no right click +1 moreWP Content Copy Protection & No Right Click (premium) <= 15.0 - Admin+ Stored XSS4.8 Medium
- unknown wccp-pro, wp-buy wp content copy protection \& no right click +1 moreWP Content Copy Protection & No Right Click (premium) < 15.3 - Open Redirect6.1 Medium
- unknown profileproprofilepro <= 1.3 - Subscriber+ Stored Cross Site Scripting5.4 Medium
- optimalaccess kbucket, unknown kbucket: your curated content in wordpress +1 morekbucket < 4.1.5 - Reflected XSS6.1 Medium
- optimalaccess kbucket, unknown kbucket: your curated content in wordpress +1 morekbucket < 4.1.6 - Admin+ Stored XSS4.8 Medium
- automattic jetpack boostJetpack Boost < 3.4.7 - Admin+ SSRF9.1 Critical
- orangelab imagemagick engineImageMagick Engine < 1.7.11 - Administrator+ OS Command Injection7.2 High
- thisfunctional ctt expresso para woocommerceCTT Expresso para WooCommerce < 3.2.13 - Admin+ Stored XSS4.8 Medium
- dyadyalesha dl yandex metrikaDL Yandex Metrika <= 1.2 - Admin+ Stored XSS4.8 Medium
- data443 tracking code managerTracking Code Manager < 2.3.0- Admin+ Stored Cross-Site Scripting4.8 Medium
- pnfpb push notification for post and buddypressPush Notification for Post and BuddyPress <=1.93 - Multiple Unauthenticated SQLi9.8 Critical
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreIf-So Dynamic Content Personalization < 1.8.0.3 - Contributor+ Shortcode Stored XSS5.4 Medium
- cminds cm tooltip glossaryCM Tooltip Glossary < 4.3.4 - Admin+ Stored XSS4.8 Medium
- s3bubble s3playerdrm-protected-video-streaming <= 4.2.1 - Reflected XSS6.1 Medium
- danielpowney badgearooBadgearoo <= 1.0.14 - Reflected XSS6.1 Medium
- unknown 360 product rotation360 Product Rotation <= 1.5.8 - Reflected XSS6.1 Medium
- eric teubert podlove podcast publisher, podlove podcast publisher +1 morePodlove Podcast Publisher < 4.2.1 - Admin+ Stored XSS4.8 Medium
- eric teubert podlove podcast publisher, podlove podcast publisher +1 morePodlove Podcast Publisher < 4.1.24 - Admin+ Stored XSS4.8 Medium
- memberspaceMemberSpace – Membership Plugin and Paid Subscriptions < 2.1.14 - Reflected XSS6.1 Medium
- data443 gdpr framework, unknown the gdpr framework by data443 +1 moreThe GDPR Framework By Data443 < 2.2.0 - Admin+ Stored XSS4.8 Medium
- lifterlmsLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes < 8.0.1 - Reflected XSS6.1 Medium
- e4jvikwp vikbooking hotel booking engine & pms, vikwp vikbooking hotel booking engine \& pms +1 moreVikBooking < 1.7.2 - Admin+ Stored XSS4.8 Medium
- icegram engage, unknown icegram engage +1 moreIcegram Engage < 3.1.32 - Admin+ Stored XSS4.8 Medium
- icegram engage, unknown icegram engage +1 moreIcegram Engage < 3.1.32 - Admin+ Stored XSS4.8 Medium
- unknown photo gallery, images, slider in rbs image gallery, robosoft robo gallery +1 morePhoto Gallery, Images, Slider in Rbs Image Gallery < 3.2.24 - Admin+ Stored XSS4.8 Medium
- harmonic design hd quizHD Quiz < 2.0.0 - Editor+ Stored XSS4.8 Medium
- codepeople calculated fields formCalculated Fields Form < 5.2.64 - Admin+ Stored XSS4.8 Medium
- metaphorcreations dittyDitty – Responsive News Tickers, Sliders, and Lists < 3.1.52 - Author+ Stored XSS4.8 Medium
- aweberAWeber <= 7.3.20 - Admin+ Stored XSS4.8 Medium
- thimpress learnpressLearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS4.8 Medium
- thimpress learnpressLearnPress – WordPress LMS Plugin < 4.2.7.5.1 - Admin+ Stored XSS4.8 Medium
- 10web form maker, unknown form maker by 10web +1 moreForm Maker by 10Web < 1.15.33 - Admin+ Stored XSS via Theme Title4.8 Medium
- top comments project comments, unknown top comments +1 moreTop Comments <= 1.0 - Admin+ Stored Cross-Site Scripting4.8 Medium
- f1logic custom field managerCustom Field Manager <= 1.0 - Reflected XSS Vulnerability6.1 Medium
- unknown wp erp | complete hr solution with recruitment & job listings | woocommerce crm & accounting, wedevs wp erp +1 moreWP ERP < 1.13.4 - Custom+ Unauthorized Access to Terminated Employee Information7.5 High
- unknown wp erp | complete hr solution with recruitment & job listings | woocommerce crm & accounting, wedevs wp erp +1 moreWP ERP | Complete HR solution with recruitment < 1.13.4 - Admin+ Stored XSS4.8 Medium
- brijeshk89 ip based loginIP Based Login < 2.4.1 - Admin+ Stored XSS4.8 Medium
- alimir wp ulikeWP ULike < 4.7.6 - Admin+ Stored XSS4.8 Medium
- raiserweb competition formCompetition Form <= 2.0 - Competition Deletion via CSRF4.3 Medium
- automattic mailpoetMailPoet < 5.5.2 - Admin+ Stored XSS4.8 Medium
- annabansaghi mobile contact barMobile Contact Bar < 3.0.5 - Admin+ Stored XSS4.8 Medium
- niceit advance post prefixAdvance Post Prefix <= 1.1.1 - Admin+ SQL Injection7.2 High
- niceit advance post prefixAdvance Post Prefix <= 1.1.1 - Reflected XSS6.1 Medium
- cr1000 affiliateimporterebAffiliateImporterEb <= 1.0.6 - Reflected XSS via Search6.1 Medium
- cr1000 affiliateimporterebAffiliateImporterEb <= 1.0.6 - Reflected XSS6.1 Medium
- Show moreLoading…