CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- whmpressWordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability8.1 High
- imithemes eventerWordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability4.3 Medium
- valvepress rankieWordPress Rankie plugin < 1.8.2 - Broken Access Control Vulnerability4.3 Medium
- whmpressWordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability7.5 High
- nasatheme nasa coreWordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerability7.5 High
- valvepress pinterest automatic pinWordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control Vulnerability4.3 Medium
- themencode tnc flipbookWordPress TNC FlipBook plugin <= 12.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- scripteo ads proWordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- blaze concepts better customer list for woocommerceWordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- quanticalabs css3 compare pricing tables for wordpressWordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control Vulnerability5.4 Medium
- valvepress wordpress auto spinnerWordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control Vulnerability4.3 Medium
- romancode mapsvgWordPress MapSVG plugin < 8.6.13 - Broken Access Control Vulnerability5.0 Medium
- romancode mapsvgWordPress MapSVG plugin <= 8.5.31 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- villatheme curcyWordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- romancode mapsvgWordPress MapSVG plugin <= 8.5.34 - Content Injection Vulnerability5.3 Medium
- lambertgroup video player & fullscreen video backgroundWordPress Video Player & FullScreen Video Background plugin <= 2.4.1 - SQL Injection vulnerability7.6 High
- ashanjay eventonWordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerability5.3 Medium
- roninwp fat services bookingWordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerability7.5 High
- lupsonline seo flow by lupsonline, seo flow +1 moreWordPress SEO Flow by LupsOnline plugin <= 2.2.1 - CSRF to Stored XSS vulnerability7.1 High
- sidngr import export for woocommerceWordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability7.1 High
- bertha ai, berthaai bertha ai +1 moreWordPress BERTHA AI plugin <= 1.13 - Broken Access Control Vulnerability4.3 Medium
- proxymis interviewWordPress Interview plugin <= 1.01 - SQL Injection Vulnerability8.5 High
- estatik mortgage calculator estatik, mortgage calculator +1 moreWordPress Mortgage Calculator Estatik plugin <= 2.0.12 - Local File Inclusion Vulnerability7.5 High
- aptivada for wp, aptivadadev aptivada for wp +1 moreWordPress Aptivada for WP plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- shapedplugin wp tabsWordPress WP Tabs plugin <= 2.2.12 - PHP Object Injection Vulnerability7.2 High
- pencilwp x addons for elementorWordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- saiful islam ultraaddons elementor liteWordPress UltraAddons Elementor Lite plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- sharespine woocommerce connectorWordPress Sharespine Woocommerce Connector plugin <= 4.7.55 - Broken Access Control Vulnerability4.3 Medium
- app cheap push notification for mobile and web appWordPress Push notification for Mobile and Web app plugin <= 2.0.3 - Broken Access Control vulnerability6.5 Medium
- steve puddick wp notes widgetWordPress WP Notes Widget plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- romancode mapsvgWordPress MapSVG Lite plugin <= 8.6.9 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- rs wp themes wp book showcaseWordPress RS WP Book Showcase plugin <= 6.7.59 - Content Injection vulnerability5.3 Medium
- kilbot woocommerce posWordPress WooCommerce POS plugin <= 1.7.8 - Broken Access Control Vulnerability5.3 Medium
- ashan perera eventonWordPress EventON plugin <= 2.4.4 - Broken Access Control Vulnerability5.3 Medium
- javier revilla validatecertifyWordPress ValidateCertify plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- shayan farhang pazhooh shayanweb admin fontchanger, shayanweb admin fontchanger +1 moreWordPress ShayanWeb Admin FontChanger plugin <= 1.9.1 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- broadstreet adsWordPress Broadstreet plugin <= 1.51.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- karimmughal dot html,php,xml etc pagesWordPress Dot html,php,xml etc pages plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- uncanny owl toolkit for learndashWordPress Uncanny Toolkit for LearnDash plugin <= 3.7.0.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- metagauss profilegridWordPress ProfileGrid plugin <= 5.9.5.1 - Broken Access Control Vulnerability4.3 Medium
- oretnom23 stock management systemSourceCodester/oretnom23 Stock Management System view_return sql injection5.3 Medium
- mongodb bson::xsBSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities9.8 Critical
- phpgurukul daily expense tracker systemPHPGurukul Daily Expense Tracker System user-profile.php sql injection6.9 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server vulnerable to insecure temporary file creation, race with write access and permission2.6 Low
- nextcloud server, kiteworks security-advisories, nextcloud group folders +2 moreNextcloud Server and Groupfolders app vulnerable to bypass of group folder quota limit using attachment in text file4.3 Medium
- oretnom23 stock management systemSourceCodester/oretnom23 Stock Management System view_receiving sql injection5.3 Medium
- phpgurukul park ticketing management systemPHPGurukul Park Ticketing Management System forgot-password.php sql injection5.3 Medium
- freerdp, red hat enterprise linux 10, enterprise linux 8 +2 more +4 moreGnome-remote-desktop: freerdp: unauthenticated rdp packet causes segfault in freerdp leading to denial of service6.5 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop 3rdparty applications can create share links via socket API5.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server's test remote endpoint is not rate limited4.3 Medium
- Show moreLoading…