CVEs published in June 2025
3,618 vulnerabilities, 289 critical, 18 exploited.
- michel - xiligroup dev xili-dictionaryWordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) Vulnerability7.1 High
- infility globalWordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerability7.1 High
- real-web realtyeliteWordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability8.1 High
- designthemes lmsWordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability7.1 High
- john russell national weather service alertsWordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability8.1 High
- creanncy davenport - versatile blog and magazine wordpress themeWordPress Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Local File Inclusion Vulnerability8.1 High
- tmrw-studio katerio - magazineWordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion Vulnerability8.1 High
- apuswp domnooWordPress Domnoo theme <= 1.49 - Local File Inclusion Vulnerability8.1 High
- ancorathemes citygovWordPress CityGov theme <= 1.9 - Local File Inclusion Vulnerability8.1 High
- ovatheme brwWordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerability8.1 High
- zealousweb abandoned contact form 7WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerability8.2 High
- themehunk zitaWordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability8.1 High
- dejan jasnic trusty whistleblowingWordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerability8.2 High
- uxper salaWordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability8.8 High
- mdjm mobile dj managerWordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerability8.8 High
- uxper nussWordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerability8.8 High
- favethemes homeyWordPress Homey theme <= 2.4.7 - SQL Injection vulnerability9.3 Critical
- directiq email marketingWordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection Vulnerability9.3 Critical
- snstheme samex - clean, minimal shop woocommerce wordpress themeWordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability8.1 High
- dugudlabs specfit-virtual try on woocommerceWordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpopal gg bought together for woocommerceWordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability9.3 Critical
- fastw3b llc fw galleryWordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion Vulnerability8.1 High
- goalthemes sofassWordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerability8.1 High
- syed tahir ali jan bulk youtube post creatorWordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- fastw3b llc fw food menuWordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Deletion Vulnerability8.6 High
- comet system h3531, p8510, p8552 +17 more +19 moreComet System H3531 Web-based Management setupA.cfg missing authentication9.2 Critical
- diyhi bbsdiyhi bbs HTTP Header login getUrl server-side request forgery5.3 Medium
- kingdee cloud-starry-sky enterprise editionKingdee Cloud-Starry-Sky Enterprise Edition Freemarker Engine DynamicForm 4 Action.class plugin.buildMobilePopHtml special elements used in a template engine6.9 Medium
- kstover ninja forms – the contact form builder that grows with you, ninjaforms ninja forms +1 moreNinja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI6.4 Medium
- techjewel ninja tables – easy data table builder, wpmanageninja ninja tables +1 moreNinja Tables – Easy Data Table Builder <= 5.0.18 - Unauthenticated Server-Side Request Forgery7.2 High
- scriptsbundle dwt - directory & listing wordpress themeDWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset9.8 Critical
- artica pandora fms, pandora fms fms +1 moreCommand Injection in Netflow path7.0 High
- ido kobelkowsky simple paymentSimple Payment 1.3.6 - 2.3.8 - Authentication Bypass to Admin9.8 Critical
- innate-images-llc vr calendar, vr calendar project calendar +1 moreVR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync4.3 Medium
- webangon the pack elementor addon, the pack elementor addons +1 moreThe Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- osompress osom blocksOsom Blocks <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via class_name Parameter6.4 Medium
- armandofiore fl3r accessibility suite, fl3r accessibility suite +1 moreFL3R Accessibility Suite <= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via fl3raccessibilitysuite Shortcode6.4 Medium
- johnjamesjacoby a/b testing for wordpressA/B Testing for WordPress <= 1.18.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- boonebgorges buddypress docsBuddyPress Docs < 2.2.5 - Subscriber+ Arbitrary Document Read/Update4.3 Medium
- unknown wp map block, wp map block project map block +1 moreWP Map Block by aBlocks < 2.0.3 - Contributor+ Stored XSS via Marker4.8 Medium
- dfactory responsive lightbox, unknown responsive lightbox & gallery +1 moreResponsive Lightbox & Gallery < 2.5.2 - Contributor+ Stored XSS5.4 Medium
- firelightwp firelight lightboxFirelight Lightbox < 2.3.16 - Contributor+ Stored XSS5.4 Medium
- tb-eye ltd. hrx-1621/te, hrx-1635/te, hrx-421fn/te +14 more +16 moreBuffer Overflow vulnerability exists in multiple versions of TB-eye network recorders and AHD...6.9 Medium
- tb-eye ltd. hrx-1621/te, hrx-1635/te, hrx-421fn/te +14 more +16 moreAn OS command injection issue exists in multiple versions of TB-eye network recorders and AHD...8.6 High
- jairoochoa ismobile() shortcode for wordpressisMobile <= 1.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via device Parameter6.4 Medium
- huija bicyclesharingserverhuija bicycleSharingServer AdminController.java selectAdminByNameLike sql injection5.3 Medium
- linksys ea7200, ea7450, ea7500 +1 more +3 moreLinksys WRT1900ACS/EA7200/EA7450/EA7500 IGD Layer3Forwarding SetDefaultConnectionService stack-based overflow8.7 High
- linksys e8450Linksys E8450 HTTP POST Request portal.cgi set_device_language buffer overflow8.7 High
- hdfgroup hdf5HDF5 H5Omtime.c H5O__mtime_new_encode heap-based overflow4.8 Medium
- huija bicyclesharingserverhuija bicycleSharingServer AdminController.java searchAdminMessageShow sql injection5.3 Medium
- Show moreLoading…