CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- danny vink user profile meta managerWordPress User Profile Meta Manager plugin <= 1.02 - CSRF to Privilege Escalation vulnerability9.8 Critical
- directorythemes tigerWordPress Tiger theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- roninwp revyWordPress Revy plugin <= 2.1 - SQL Injection vulnerability8.5 High
- fantasticplugins sumo reward pointsWordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerability8.3 High
- themegoods grand restaurantWordPress Grand Restaurant WordPress theme <= 7.0 - Path Traversal to PHP Object Injection vulnerability9.8 Critical
- chimpgroup foodbakeryWordPress FoodBakery plugin <= 3.3 - PHP Object Injection vulnerability9.8 Critical
- themegoods altairWordPress Altair theme <= 5.2.2 - PHP Object Injection vulnerability9.8 Critical
- themegoods grand restaurantWordPress Grand Restaurant WordPress theme <= 7.0 - PHP Object Injection vulnerability9.8 Critical
- potenzaglobalsolutions ciyashopWordPress CiyaShop theme <= 4.18.0 - PHP Object Injection vulnerability9.8 Critical
- rocket apps wprojectWordPress wProject theme < 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability8.2 High
- themegoods grand restaurantWordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability8.2 High
- themegoods grand conferenceWordPress Grand Conference theme <= 5.3 - PHP Object Injection vulnerability9.8 Critical
- roninwp fat services bookingWordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerability8.5 High
- chimpstudio foodbakery sticky cartWordPress Foodbakery Sticky Cart plugin <= 3.2 - PHP Object Injection vulnerability9.8 Critical
- mojoomla hospital management systemWordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability8.5 High
- ctltwp section widgetWordPress Section Widget plugin <= 3.3.1 - Path Traversal vulnerability5.3 Medium
- rocket apps wprojectWordPress wProject theme < 5.8.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- rocket apps wprojectWordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerability8.8 High
- elbisnero wordpress events calendar registration & ticketsWordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mojoomla hospital management systemWordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability10.0 Critical
- mojoomla hospital management systemWordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability9.3 Critical
- solid plugins analyticswpWordPress AnalyticsWP <= 2.1.2 - SQL Injection Vulnerability9.3 Critical
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerability7.1 High
- samlify project samlifysamlify SAML Signature Wrapping attack9.9 Critical
- mojoomla hospital management systemWordPress Hospital Management System plugin <= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerability7.1 High
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability9.3 Critical
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability10.0 Critical
- symfony uxsymfony/ux-live-component and symfony/ux-twig-component vulnerable to unsanitized HTML attribute injection via ComponentAttributes6.1 Medium
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 (17-08-2023) - Arbitrary File Upload vulnerability9.9 Critical
- expressjs multerMulter vulnerable to Denial of Service from maliciously crafted requests7.5 High
- expressjs multerMulter vulnerable to Denial of Service via memory leaks from unclosed streams7.5 High
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability8.5 High
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 (17-08-2023) - Privilege Escalation vulnerability8.8 High
- mojoomla wpamsWordPress WPAMS plugin <= 44.0 - Local File Inclusion to Privilege Escalation vulnerability9.8 Critical
- caseproof, llc memberpressWordPress Memberpress plugin < 1.12.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- pressaholic wordpress video robot - the ultimate video importerWordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themegusta smart sections theme builder - wpbakery page builder addonWordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerability9.8 Critical
- indie plugins whatsapp click to chat plugin for wordpressWordPress WhatsApp Click to Chat Plugin for WordPress plugin <= 2.2.12 - Local File Inclusion vulnerability7.5 High
- openpgpjsOpenPGP.js's message signature verification can be spoofed8.7 High
- highwarden super store finderWordPress Super Store Finder <= 7.2 - SQL Injection Vulnerability9.3 Critical
- booster for woocommerce, pluggabl llc booster plus for woocommerce +1 moreWordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- gardenerGardener vulnerable to metadata injection for a project secret that can lead to privilege escalation9.9 Critical
- crocoblock jetelements for elementorWordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control Vulnerability7.5 High
- crocoblock jetwoobuilderWordPress JetWooBuilder plugin <= 2.1.18 - Broken Access Control Vulnerability7.5 High
- crocoblock jetblocks for elementorWordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability7.5 High
- mikado-themes fotonWordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerability8.1 High
- contempo themes real estate 7WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability7.3 High
- gardenerBypassing project secret validation can lead to privilege escalation9.9 Critical
- andreyk remote images grabberWordPress Remote Images Grabber plugin <= 0.6 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- confuzzledduck syndicate outWordPress Syndicate Out <= 0.9 - Cross Site Scripting (XSS) Vulnerability7.1 High
- Show moreLoading…