CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- pdfcrowd save as pdf, unknown save as image plugin by pdfcrowd +1 moreSave as PDF by Pdfcrowd < 3.2.2 - Admin+ Stored XSS4.8 Medium
- merv barrett easy property listingsEasy Property Listings <= 3.5.3 - Admin+ Stored XSS4.8 Medium
- premio my sticky bar, unknown floating notification bar, sticky menu on scroll, announcement banner, and sticky header for any theme +1 moreMy Sticky Bar < 2.6.8 - Admin+ Stored XSS4.8 Medium
- texttheater ultimate noindex nofollow tool iiUltimate Noindex Nofollow Tool II < 1.3.6 - Admin+ Stored XSS4.8 Medium
- buddyboss platform, unknown buddyboss-platform +1 moreBuddyBoss platform < 2.7.60 - Private Comment Exposure via IDOR3.5 Low
- mooveagency user activity tracking and logUser Activity Tracking and Log < 4.1.4 - IP Spoofing5.3 Medium
- dev4press coreactivity, gdragon coreactivity: activity logging for wordpress +1 morecoreActivity < 1.8.1 - Unauthenticated Stored XSS8.8 High
- hijiriworld advanced schedule postsAdvanced Schedule Posts <= 2.1.8 - Reflected XSS7.1 High
- reneade twitterpostsTwitterPosts <= 1.0.2 - Settings Update via CSRF3.5 Low
- jeroensormani wp dashboard noteswp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR7.5 High
- unknown illi link party!, evanliewer illi link party\! +1 moreilli Link Party! <= 1.0 - Unauthenticated Arbitrary Link Deletion7.3 High
- unknown illi link party!, evanliewer illi link party\! +1 moreilli Link Party! <= 1.0 - Admin+ Stored Cross-Site Scripting6.1 Medium
- unknown illi link party!, evanliewer illi link party\! +1 moreilli Link Party! <= 1.0 - Settings Update via CSRF5.5 Medium
- unknown illi link party!, evanliewer illi link party\! +1 moreilli Link Party! <= 1.0 - Unauthenticated Stored XSS6.1 Medium
- corbyboy marketing twitter botMarketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRF7.1 High
- jonkemp ultimate noindex nofollow toolUltimate Noindex Nofollow Tool <= 1.1.2 - Settings Update via CSRF4.3 Medium
- ani2life wp-reply notifyWP-Reply Notify <= 1.1 - Settings Update via CSRF4.3 Medium
- abitgone commentsafe, unknown abitgone commentsafe +1 moreaBitGone CommentSafe <= 1.0.0 - Settings Update to Stored XSS via CSRF7.1 High
- unknown better follow button for jetpack, antonpug better flow button for jetpack +1 moreBetter Follow Button for Jetpack <= 8.0 - Admin+ Stored XSS4.8 Medium
- inventivo, unknown add svg support for media uploader | inventivo +1 moreAdd SVG Support for Media Uploader | inventivo <= 1.0.5 - Author+ Stored XSS via SVG5.4 Medium
- ablyperu svg uploads supportSVG Uploads Support <= 2.1.1 - Author+ Stored XSS via SVG5.4 Medium
- hkdigit payment gateway for telcellPayment Gateway for Telcell <= 2.0.1 - Unauthenticated Open Redirect6.1 Medium
- unknown wolfnet idx for wordpressWolfNet IDX for WordPress <= 1.19.1 - Admin+ Stored XSS4.8 Medium
- unknown allow svgAllow SVG < 1.2.0 - Author+ Stored XSS via SVG6.1 Medium
- deryckoe logdash activity logLogDash Activity Log < 1.1.4 - Unauthenticated SQLi5.4 Medium
- travelpayouts, unknown travelpayouts: all travel brands in one place +1 moreTravelpayouts < 1.1.13 - Settings Update via CSRF7.3 High
- travelpayouts, unknown travelpayouts: all travel brands in one place +1 moreTravelpayouts < 1.1.14 - Reflected XSS4.8 Medium
- pagevisitcounter advanced page visit counterAdvanced Page Visit Counter <= 8.0.6 - Admin+ Stored XSS4.8 Medium
- unknown easy digital downloads google sheet connector, edd-google-sheet-connector-pro, gsheetconnector edd gsheetconnector +2 moreEasy Digital Downloads Google Sheet Connector < 1.6.6 - Access Code Update via CSRF5.4 Medium
- mantus667 wp-pmanagerWP-PManager <= 1.2 - Admin+ SQL Injection5.4 Medium
- mantus667 wp-pmanagerWP-PManager <= 1.2 - Category Deletion via CSRF5.4 Medium
- funnelkit funnel builder, unknown funnelkit +1 moreWooCommerce Checkout & Funnel Builder by FunnelKit < 3.10.2 - Admin+ SQL Injection6.1 Medium
- ninja pages project pages, unknown ninja pages +1 moreNinja Pages <= 1.4.2 - Admin+ Stored XSS5.4 Medium
- coffee-code plugin oficialPlugin Oficial – Getnet para WooCommerce <= 1.7.3 - Unauthenticated Reflected XSS6.1 Medium
- coffee-code plugin oficialPlugin Oficial – Getnet para WooCommerce <= 1.7.3 - Admin+ Stored XSS4.8 Medium
- bulktheme wooeximwooexim <= 5.0.0 - CSRF to Reflected XSS6.1 Medium
- sfarbota download html tinymce buttonDownload HTML TinyMCE Button <= 1.2 - Reflected XSS6.1 Medium
- danielpowney badgearooBadgearoo <= 1.0.14 - Admin+ Stored XSS4.8 Medium
- unknown spiritual gifts survey (and optional s.h.a.p.e survey), mynamedia spiritual gifts survey \(and optional s.h.a.p.e survey\) +1 moreSpiritual Gifts Survey <= 0.9.10 - Unauthenticated CSRF to XSS6.1 Medium
- unknown spiritual gifts survey (and optional s.h.a.p.e survey), mynamedia spiritual gifts survey \(and optional s.h.a.p.e survey\) +1 moreSpiritual Gifts Survey <= 0.9.10 - Unauthenticated CSRF to XSS6.1 Medium
- quantumcloud wpbot, unknown ai chatbot for wordpress +1 moreAI ChatBot for WordPress – WPBot < 6.2.4 - Admin+ Stored XSS4.8 Medium
- salonbookingsystem salon booking system, unknown salon booking system, appointment scheduling for salons, spas & small businesses +1 moreSalon Booking System < 10.9.4 - Admin+ Stored XSS4.8 Medium
- melapress file monitor, unknown melapress file monitor +1 moreWebsite File Changes < 2.1.1 - Authenticated SQL Injection5.4 Medium
- flamescorpion auto affiliate linksAuto Affiliate Links < 6.4.7 - Admin+ SQL Injection5.4 Medium
- taskbuilderTaskbuilder < 3.0.9 - Admin+ SQL Injection7.2 High
- lukashuser ekc tournament managerEKC Tournament Manager < 2.2.2 - Local File Download Vulnerability6.5 Medium
- lukashuser ekc tournament managerEKC Tournament Manager < 2.2.2 - Delete Tournaments via CSRF5.4 Medium
- lukashuser ekc tournament managerEKC Tournament Manager < 2.2.2 - Create Tournaments/Teams via CSRF5.4 Medium
- gregross cyan backupCYAN Backup < 2.5.3 - Admin+ Stored XSS via Remote Storage Settings5.4 Medium
- gregross cyan backupCYAN Backup < 2.5.3 - Admin+ Stored XSS via General Settings5.4 Medium
- Show moreLoading…