CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- brewlabs wp email deliveryWordPress WP Email Delivery plugin <= 1.20.11.23 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- revmakx backup and staging by wp time capsuleWordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- fahad mahmood stock locations for woocommerceWordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability7.1 High
- moreconvert mc woocommerce wishlistWordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability7.1 High
- info@welcart welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability6.8 Medium
- romancode mapsvgWordPress MapSVG plugin < 8.6.13 - Privilege Escalation Vulnerability8.8 High
- icegram collectWordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability7.1 High
- click5 history log by click5WordPress History Log by click5 plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- infility globalWordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability8.5 High
- sonalsinha21 recover abandoned cart for woocommerceWordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability9.3 Critical
- holest engineering spreadsheet price changer for woocommerce and wp e-commerce – lightWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - SQL Injection Vulnerability9.3 Critical
- holest engineering spreadsheet price changer for woocommerce and wp e-commerce – lightWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Arbitrary File Download Vulnerability7.5 High
- holest engineering spreadsheet price changer for woocommerce and wp e-commerce – lightWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability10.0 Critical
- wp event manager event managerWordPress WP Event Manager plugin <= 3.1.51 - Local File Inclusion Vulnerability8.1 High
- g5plus essential real estateWordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability8.1 High
- holest engineering spreadsheet price changer for woocommerce and wp e-commerce – lightWordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability9.8 Critical
- spicethemes spice blocksWordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability7.5 High
- relentlo styleaiWordPress StyleAI plugin <= 1.0.4 - Broken Access Control Vulnerability6.5 Medium
- metalpriceapiWordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability9.9 Critical
- alex zaytseff multi cryptocurrency paymentsWordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability9.3 Critical
- crypto cloud cryptocloud - crypto payment gatewayWordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability6.5 Medium
- salesup2019 formulario de contacto salesup!WordPress Formulario de contacto SalesUp! plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- multivendorxWordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability7.5 High
- thimpress wp pipesWordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability8.6 High
- richard perdaan wc myparcel belgiumWordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- wp swings membership for woocommerceWordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability7.5 High
- mystyleplatform mystyle custom product designerWordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability9.3 Critical
- unfoldwp blogbyteWordPress Blogbyte theme <= 1.1.1 - Local File Inclusion Vulnerability8.1 High
- unfoldwp blogmineWordPress Blogmine theme <= 1.1.7 - Local File Inclusion Vulnerability8.1 High
- unfoldwp blogtyWordPress Blogty theme <= 1.0.11 - Local File Inclusion Vulnerability8.1 High
- unfoldwp blogpriseWordPress Blogprise theme <= 1.0.9 - Local File Inclusion Vulnerability8.1 High
- unfoldwp blogvyWordPress Blogvy theme <= 1.0.7 - Local File Inclusion Vulnerability8.1 High
- unfoldwp magtyWordPress Magty theme <= 1.0.6 - Local File Inclusion Vulnerability8.1 High
- unfoldwp magzeWordPress Magze theme <= 1.0.9 - Local File Inclusion Vulnerability8.1 High
- unfoldwp magwaysWordPress Magways theme <= 1.2.1 - Local File Inclusion Vulnerability8.1 High
- mikado-themes mediclinicWordPress MediClinic theme <= 2.1 - Local File Inclusion Vulnerability8.1 High
- mikado-themes grandprixWordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability8.1 High
- mikado-themes grill and chowWordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability8.1 High
- konica minolta bizhubKonica Minolta bizhub cross-site request forgery5.3 Medium
- konica minolta bizhubKonica Minolta bizhub Display MFP Information List cross site scripting5.1 Medium
- code-projects chat systemcode-projects Chat System confirm_password.php sql injection5.3 Medium
- No product listedWhistle get-temp-file path traversal5.3 Medium
- knadh listmonklistmonk's Sprig template Injection vulnerability leads to reading of Environment Variable for low privilege user9.1 Critical
- wukongopensource wukongcrm, 72crm wukong crm +1 moreWuKongOpenSource WukongCRM File Upload AdminSysConfigController.java cross site scripting5.1 Medium
apportUbuntuapport regressionNo score- barryvdh laravel-translation-managerLaravel Translation Manager Vulnerable to Stored Cross-site Scripting6.0 Medium
- wilderforgeWilderForge vulnerable to code Injection via GitHub Actions Workflows10.0 Critical
- fastgptFastGPT Sandbox Vulnerable to Sandbox Bypass6.3 Medium
- wasp-lang waspWasp has case insensitive OAuth ID vulnerability8.2 High
- discourseDiscourse vulnerable to auto-executing of third-party code in embedded CodePen iframe8.1 High
- Show moreLoading…