CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- pickplugins post grid, unknown post grid, posts slider, posts carousel, post filter, post masonry +1 morePost Grid and Gutenberg Blocks < 2.2.93 - Contributor+ Stored XSS5.4 Medium
- ays-pro popup boxPopup Box < 4.7.8 - Admin+ Stored XSS5.4 Medium
- syntacticsinc easync, unknown free booking plugin for hotels, restaurants and car rentals +1 moreFree Booking Plugin for Hotels, Restaurants and Car Rentals – eaSYNC Booking < 1.3.15 - Subscriber+ PayPal Settings Update6.5 Medium
- metagauss registrationmagicRegistrationMagic < 6.0.2.1 - Stored XSS4.8 Medium
- grandplugins avif uploaderAVIF & SVG Uploader <= 1.1.0 - Author+ Stored XSS via SVG Uplaod5.4 Medium
- radiustheme team, team - wordpress team members showcase +1 moreTeam Members Showcase < 4.4.2 - Editor+ Stored XSS4.8 Medium
- gsplugins logo sliderGS Logo Slider < 3.7.1 - Settings Update via Cross-Site Request Forgery4.3 Medium
- blubrry powerpress, powerpress podcasting plugin by blubrry +1 morePowerPress Podcasting < 11.9.18 - Author+ XSS4.8 Medium
- unknown maspikMaspik - Advanced Spam protection < 2.1.3 - Admin+ Stored XSS4.8 Medium
- codepeople polls cpPolls CP <= 1.0.75 - Admin+ Stored XSS via Custom Styles5.4 Medium
- codepeople polls cpPolls CP <= 1.0.75 - Admin+ Stored Cross-Site Scripting5.4 Medium
- kylephillips nested pagesNested Pages <= 3.2.8 - Editor+ Stored XSS4.8 Medium
- unknown z-downloadsZ-Downloads < 1.11.6 - Unauthenticated Stored XSS6.1 Medium
- unknown backup databaseBackup Database <= 4.9 - Admin+ Stored XSS4.8 Medium
- unknown events-calendar, snumb130 events calendar +1 moreEvent Calendar <= 1.0.4 - Admin+ Stored XSS4.8 Medium
- total-soft event calendarEvent Calendar <= 1.0.4 - Unauthenticated Arbitrary Calendar Deletion7.5 High
- unknown z-downloadsZ-Downloads < 1.11.5 - Admin+ Arbitrary File Upload7.2 High
- unknown z-downloadsZ-Downloads < 1.11.7 - Admin+ Stored XSS via SVG Upload9.1 Critical
- 10web photo gallery by 10web, photo gallery +1 morePhoto Gallery by 10Web < 1.8.29 - Admin+ Stored XSS4.8 Medium
- mappresspro mappress, unknown mappress maps for wordpress +1 moreMapPress Maps for WordPress < 2.93 - Admin+ Stored XSS via Map Settings4.8 Medium
- unknown ajax search lite, wp-dreams ajax search +1 moreAjax Search Lite <= 4.12.2 - Admin+ Stored XSS4.8 Medium
- pagelayer, unknown page builder: pagelayer +1 morePage Builder: Pagelayer < 1.9.0- Admin+ Stored XSS4.8 Medium
- ays pro quiz makerQuiz Maker <= 6.5.9.8 - Admin+ Stored XSS4.8 Medium
- unknown everest formsEverest Forms < 3.0.3.1 - Admin+ Stored XSS4.8 Medium
- stellarwp the events calendarThe Events Calendar < 6.6.4 - Admin+ Stored XSS4.8 Medium
- unknown hustleHustle < 7.8.5 - Admin+ Stored XSS4.8 Medium
- pagelayer, unknown page builder: pagelayer +1 morePagelayer < 1.8.8 - Admin+ Stored XSS4.8 Medium
- philipwalton simple nav archivesSimple Nav Archives <= 2.1.3 - Settings Update via CSRF4.3 Medium
- unknown webtoffee-gdpr-cookie-consent, webtoffee gdpr cookie consent +1 moreGDPR Cookie Consent <= 2.6.0 - Unauthenticated Stored XSS5.4 Medium
- unknown webtoffee-gdpr-cookie-consent, webtoffee gdpr cookie consent +1 moreGDPR Cookie Consent <= 2.6.0 - Bulk Delete via CSRF6.5 Medium
- codename065 download managerDownload Manager <= 3.2.98 - Admin+ Stored XSS4.8 Medium
- gamipress - reset user, ruben garcia gamipress +1 moreGamiPress - Reset User <= 1.0.0 - GamiPress User Data Removal via CSRF4.3 Medium
- shapedplugin smart post showSmart Post Show <= 3.0.0 - Editor+ Stored XSS4.8 Medium
- unknown babelz, ryanchristenson babeiz +1 moreBabelZ – Google Translate Widget <= 1.1.5 - CSRF to Stored XSS6.1 Medium
- unknown ntz antispam, ionutstaicu ntz atispam +1 moreNtz Antispam <= 2.0e - Settings Update via CSRF6.5 Medium
- unknown javascript logic, justintadlock javascript-logic +1 moreJavaScript Logic <= 0.1 - CSRF to Stored XSS6.1 Medium
- solidcode peoplepondPeoplePond <= 1.1.9 - CSRF to Stored XSS6.1 Medium
- justintadlock widgets resetWidgets Reset <= 0.1 - Settings Update via CSRF4.3 Medium
- jfarthing custom author baseCustom Author Base <= 1.1.1 - Settings Update via CSRF4.3 Medium
- ulfbenjaminsson smooth gallery replacementSmooth Gallery Replacement <= 1.0 - CSRF to Stored XSS6.1 Medium
- unknown secure downloadsSecure Downloads < 1.2.3 - Admin+ Arbitrary File Download6.5 Medium
- clicksold idx, unknown clicksold idx +1 moreWordpress Clicksold IDX Plugin <= 1.90 - Admin+ XSS4.8 Medium
- presstigers simple job boardSimple Job Board < 2.12.6 - Unauthenticated Resumes Download3.7 Low
- presstigers simple job boardSimple Job Board < 2.12.2 - Admin+ Stored XSS6.1 Medium
- unknown pwa for wp, magazine3 pwa for wp \& amp +1 morePWA For WP & AMP < 1.7.72 Administrator+ Stored XSS4.8 Medium
- design stylish price listStylish Price List < 7.1.8 - Contributor+ Stored XSS4.8 Medium
- missionmike simple shareWordpress Simple Share Plugin <=0.5.3 - Admin+ XSS4.8 Medium
- quantumcloud simple video directorySimple Video Directory < 1.4.3 - Unauthenticated SQLi9.8 Critical
- dyadyalesha dl verificationDL Verification <= 1.2 - Admin+ Stored XSS4.8 Medium
- dyadyalesha dl robots.txtDL Robots.txt <= 1.2 - Admin+ Stored XSS4.8 Medium
- Show moreLoading…