CVEs published in May 2025
4,042 vulnerabilities, 366 critical, 19 exploited.
- sftranna ec authorize.netWordPress EC Authorize.net plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wordwebsoftware crossword compiler puzzlesWordPress Crossword Compiler Puzzles plugin <= 14.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wordwebsoftware crossword compiler puzzlesWordPress Crossword Compiler Puzzles plugin <= 5.2 - Arbitrary File Upload Vulnerability9.9 Critical
- phpaddicted igit related posts with thumb image after postsWordPress IGIT Related Posts With Thumb Image After Posts plugin <= 4.5.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- m a vinoth kumar category widgetWordPress Category Widget plugin <= 2.0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- likecoin web3pressWordPress Web3Press – Decentralize Publishing with Writing NFT plugin <= 3.2.0 - Arbitrary File Read vulnerability6.5 Medium
- janekniefeldt my custom widgetsWordPress My Custom Widgets plugin <= 2.0.5 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wpjobportal wp job portalWordPress WP Job Portal plugin <= 2.3.1 - Local File Inclusion vulnerability8.1 High
- wpfable fable extraWordPress Fable Extra plugin <= 1.0.6 - SQL Injection Vulnerability9.3 Critical
- ctltwp section widgetWordPress Section Widget plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- b2itech b2i investor toolsWordPress B2i Investor Tools plugin <= 1.0.7.9 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- xylus themes wp smart importWordPress WP Smart Import plugin <= 1.1.3 - Local File Inclusion Vulnerability8.1 High
- metagauss profilegridWordPress ProfileGrid plugin <= 5.9.5.0 - SQL Injection Vulnerability8.5 High
- mediaticus subaccounts for woocommerceWordPress Subaccounts for WooCommerce plugin <= 1.6.6 - Account Takeover vulnerability8.8 High
- tainacanWordPress Tainacan plugin <= 0.21.14 - Arbitrary File Deletion vulnerability8.6 High
- add-ons.org drag and drop file upload for elementor formsWordPress Drag and Drop File Upload for Elementor Forms plugin <= 1.4.3 - Arbitrary File Deletion Vulnerability8.6 High
- ux design experts experto cta widget – call to action, sticky cta, floating button pluginWordPress Experto CTA Widget – Call To Action, Sticky CTA, Floating Button Plugin <= 1.1.1 - Settings Change Vulnerability6.5 Medium
- james laforge infocob crm formsWordPress Infocob CRM Forms plugin <= 2.4.0 - Arbitrary File Download vulnerability4.9 Medium
- coinpayments coinpayments.net payment gateway for woocommerceWordPress CoinPayments.net Payment Gateway for WooCommerce plugin <= 1.0.17 - PHP Object Injection Vulnerability9.8 Critical
- wpfunnelsWordPress WPFunnels plugin <= 3.5.18 - PHP Object Injection Vulnerability9.8 Critical
- arraytics eventinWordPress Eventin plugin <= 4.0.26 - Privilege Escalation Vulnerability9.8 Critical
- wpopal opal woo custom product variationWordPress Opal Woo Custom Product Variation plugin <= 1.2.0 - Arbitrary File Deletion Vulnerability8.6 High
- romancode mapsvgWordPress MapSVG plugin < 8.6.13 - Broken Access Control vulnerability7.5 High
- unknown mail mintWordPress Mail Mint plugin <= 1.17.7 - Sensitive Data Exposure Vulnerability7.5 High
- facturanteWordPress Facturante plugin <= 1.11 - SQL Injection Vulnerability9.3 Critical
- mojoomla school managementWordPress School Management plugin <= 92.0.0 - SQL Injection vulnerability8.5 High
- digitalzoomstudio zoomsoundsWordPress ZoomSounds plugin <= 6.91 - PHP Object Injection vulnerability9.8 Critical
- khaled user metaWordPress User Meta plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- belingo belingogeoWordPress belingoGeo plugin <= 1.12.0 - Arbitrary File Download Vulnerability7.5 High
- mortgage calculator bmi adult & kid calculatorWordPress BMI Adult & Kid Calculator plugin <= 1.2.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mojoomla school managementWordPress School Management System for Wordpress plugin <= 92.0.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- mojoomla hospital management systemWordPress Hospital Management System plugin <= 47.0(20-11-2023) - Privilege Escalation vulnerability8.8 High
- 6storage rentalsWordPress 6Storage Rentals plugin <= 2.20.2 - Broken Access Control vulnerability6.5 Medium
- staggsWordPress STAGGS plugin <= 2.11.0 - Arbitrary File Upload Vulnerability10.0 Critical
- printcart web to print product designer for woocommerceWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.3.9 - Arbitrary File Upload Vulnerability10.0 Critical
- printcart web to print product designer for woocommerceWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.0 - SQL Injection Vulnerability9.3 Critical
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreWordPress ELEX HelpDesk & Customer Ticketing System plugin <= 3.2.9 - Arbitrary File Upload vulnerability9.9 Critical
- empoweringprowebsite psw front-end login & registrationWordPress PSW Front-end Login & Registration plugin <= 1.13 - Broken Authentication Vulnerability9.8 Critical
- ajar productions in5 embedWordPress Ajar in5 Embed plugin <= 3.1.5 - Arbitrary File Upload Vulnerability10.0 Critical
- mojoomla hospital management systemWordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability9.9 Critical
- codexpert, inc wc affiliateWordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability8.8 High
- letscms binary mlm planWordPress Binary MLM Plan plugin <= 3.0 - SQL Injection vulnerability7.6 High
- miniorange wordpress social login and registerWordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability8.1 High
- tyche softwares arconix shortcodesWordPress Arconix Shortcodes plugin <= 2.1.16 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- miniorange discord integrationWordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability8.1 High
- michel - xiligroup dev xili-tidy-tagsWordPress xili-tidy-tags plugin <= 1.12.06 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- funnelcockpitWordPress FunnelCockpit plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- smackcoders lead form data collection to crmWordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability8.8 High
- storekeeper b.v. for woocommerceWordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload Vulnerability10.0 Critical
- saad iqbal quick contact formWordPress Quick Contact Form plugin <= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- Show moreLoading…