CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- binti76 total donationsWordPress Total Donations <= 3.0.8 - Cross Site Scripting (XSS) Vulnerability7.1 High
- choplugins custom pc builder lite for woocommerceWordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability6.5 Medium
- shanebp bp messages toolWordPress BP Messages Tool plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- templateinvaders ti woocommerce wishlistWordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability10.0 Critical
- elbisnero wordpress events calendar registration & ticketsWordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - PHP Object Injection vulnerability9.8 Critical
- quantumcloud wpbot pro wordpress chatbotWordPress WPBot Pro Wordpress Chatbot <= 12.7.0 - PHP Object Injection Vulnerability9.8 Critical
- bslthemes tastycWordPress Tastyc < 2.5.2 - Local File Inclusion Vulnerability8.1 High
- validas wireless butlerWordPress Wireless Butler plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- dkszone celestial auraWordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability9.9 Critical
- dkszone eximiusWordPress Eximius theme <= 2.2 - Arbitrary File Upload vulnerability9.9 Critical
- candid themes gripWordPress Grip theme <= 1.0.9 - Local File Inclusion vulnerability7.5 High
- eniture technology ltl freight quotes – freightquote editionWordPress LTL Freight Quotes – FreightQuote Edition plugin <= 2.3.11 - Broken Access Control vulnerability5.4 Medium
- gardener external-dns-managementMalicious google credential in DNS secret can lead to privilege escalation9.9 Critical
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jettabsWordPress JetTabs plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jeroen peters name directoryWordPress Name Directory plugin <= 1.30.0 - Broken Access Control vulnerability4.3 Medium
- thimpress edumaWordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability5.3 Medium
- amir helzer absolute linksWordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerability7.6 High
- tox82 cookiebarWordPress cookieBAR plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ktsvetkov wp-cyr-choWordPress wp-cyr-cho plugin <= 0.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- averta master sliderWordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerability4.3 Medium
- themovation bellevueWordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerability4.3 Medium
- crocoblock jetreviewsWordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerability7.5 High
- jamesdbruner wp vegasWordPress WP Vegas plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ref checkbotWordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerability7.1 High
- zack katz mad mimi for wordpressWordPress Mad Mimi for WordPress plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- lloyd saunders author box after postsWordPress Author Box After Posts plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- charly leetham enhanced paypal shortcodesWordPress Enhanced Paypal Shortcodes plugin <= 0.5a - Cross Site Scripting (XSS) vulnerability6.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 extended lifecycle support +12 more +14 moreLibsoup: integer overflow in cookie expiration date handling in libsoup3.7 Low
- phpgurukul credit card application management systemPHPGurukul Credit Card Application Management System index.php sql injection6.9 Medium
- solid plugins analyticswpWordPress AnalyticsWP plugin <= 2.1.2 - Sensitive Data Exposure vulnerability5.3 Medium
- pressmaximum customifyWordPress Customify theme <= 0.4.8 - Broken Access Control vulnerability5.4 Medium
- themes4wp bulkWordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability5.3 Medium
- solid plugins analyticswpWordPress AnalyticsWP plugin <= 2.0.0 - Broken Access Control vulnerability5.3 Medium
- quanticalabs car park booking system for wordpressWordPress Car Park Booking System for WordPress plugin <= 2.6 - Broken Access Control vulnerability4.3 Medium
- ashok g easy child theme creatorWordPress Easy Child Theme Creator plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- aseem1234 best posts summaryWordPress Best Posts Summary plugin <= 1.0 - CSRF to Stored XSS vulnerability7.1 High
- jegtheme jnewsWordPress JNews Theme <= 11.6.16 - Broken Access Control Vulnerability5.3 Medium
- sanjeev mohindra author box plugin with different descriptionWordPress Author Box Plugin With Different Description plugin <= 1.3.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- cnilsson icafe libraryWordPress iCafe Library plugin <= 1.8.3 - SQL Injection vulnerability7.6 High
- sihibbs posts for pageWordPress Posts for Page plugin <= 2.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ed4becky rootspersonaWordPress Rootspersona plugin <= 3.7.5 - Broken Access Control vulnerability5.3 Medium
- 1000 projects daily college class work report book1000 Projects Daily College Class Work Report Book admin_info.php sql injection6.9 Medium
- themegoods grand restaurantWordPress Grand Restaurant WordPress theme <= 7.0 - Broken Access Control vulnerability5.3 Medium
- themegoods grand restaurantWordPress Grand Restaurant WordPress theme <= 7.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- pluginever product category slider for woocommerceWordPress Product Category Slider for WooCommerce plugin <= 4.3.4 - Local File Inclusion vulnerability7.5 High
- bringthepixel bimber - viral magazine wordpress themeWordPress Bimber - Viral Magazine WordPress Theme theme <= 9.2.5 - Local File Inclusion vulnerability8.8 High
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.16 - CSRF to Arbitrary Content Deletion vulnerability5.4 Medium
- templateinvaders ti woocommerce wishlistWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- connectwise risk assessmentHardcoded Key Revealed in ConnectWise Password Encryption Utility6.0 Medium
- Show moreLoading…