CVEs published in August 2025
3,709 vulnerabilities, 421 critical, 13 exploited.
- wpdevteam betterdocs – knowledge base docs & faq solution for elementor & block editorBetterDocs <= 4.1.1 - Missing Authorization to Private And Password-Protected Posts Information Disclosure5.3 Medium
- glenwpcoder drag and drop multiple file upload for contact form 7Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie5.3 Medium
- magepeopleteam e-cab taxi booking manager for woocommerceTaxi Booking Manager for Woocommerce | E-cab <= 1.3.0 - Missing Authorization to Unauthenticated Privilege Escalation via Account Takeover9.8 Critical
- cozmoslabs user profile builder – beautiful user registration forms, user profiles & user role editorUser Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- mdempfle advanced iframeAdvanced iFrame <= 2025.6 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- shopfiles ebook storeEbook Store < 5.8015 - Reflected XSS via $_SERVER['REQUEST_URI']6.1 Medium
- debian linux, linux kernel +1 moreksmbd: limit repeated connections from clients with the same IP7.5 High
- theerawat patthawee intl datetime calendarIntl DateTime Calendar <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter6.4 Medium
- lmyoaoa weichuncai(wp伪春菜)weichuncai(WP伪春菜) <= 1.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- yeashir anber elementor addonAnber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Banner button link6.4 Medium
- dasinfomedia school management system for wordpressSchool Management System <= 93.2.0 - Authenticated (Student+) Arbitrary File Upload8.8 High
- delabon woocommerce blocks – woolookWoocommerce Blocks – Woolook <= 1.7.0 - Authenticated (Admin+) Local File Inclusion6.6 Medium
- janyksteenbeek latestcheckinsLatestCheckins <= 1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- storychiefStoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload9.8 Critical
- timothyja linux promotional pluginLinux Promotional Plugin <= 1.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- loword al packAl Pack <= 1.1.1 - Missing Authorization to Unauthenticated Premium Feature Activation via check_activate_permission Function7.5 High
- dasinfomedia wpgym - wordpress gym management systemWPGYM <= 67.7.0 - Missing Authorization to Admin Account Creation8.8 High
- surbma | recent comments shortcodeSurbma | Recent Comments Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- yeashir anber elementor addonAnber Elementor Addon <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Carousel button link6.4 Medium
- dasinfomedia wpgym - wordpress gym management systemWPGYM - Wordpress Gym Management System <= 67.7.0 - Authenticated (Subscriber+) Local File Inclusion to Privilege Escalation via Password Update8.8 High
- remysharp last.fm recent album artworkLast.fm Recent Album Artwork <= 1.0.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- earnware connectEarnware Connect <= 1.0.74 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- luuptek embed bokunEmbed Bokun <= 0.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via align Parameter6.4 Medium
- dasinfomedia school management system for wordpressSchool Management System for Wordpress <= 93.2.0 - Unauthenticated SQL Injection7.5 High
- ithemes serverbuddy by pluginbuddy.comWordPress ServerBuddy by PluginBuddy.com plugin <= 1.0.5 - CSRF to PHP Object Injection vulnerability6.5 Medium
- ays-pro poll maker – versus polls, anonymous polls, image pollsPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 5.8.9 - Unauthenticated Basic Information Exposure5.3 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code7.1 High
- vancluever z2dz2d OOB drawing with new multi-sample anti-aliasing could lead to invalid memory access and corruption7.3 High
- buttercup, buttercup buttercup-browser-extension +1 moreButtercup buttercup-browser-extension Vault access control2.3 Low
- hcltech bigfix saas, hcl software bigfix saas remediate +1 moreHCL BigFix SaaS Authentication Service is affected by a SQL injection vulnerability4.3 Medium
- hcltech bigfix saas, hcl software bigfix saas remediate +1 moreHCL BigFix SaaS Authentication Service is affected by a sensitive information disclosure5.3 Medium
- hcltech bigfix saas, hcl software bigfix saas remediate +1 moreHCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting (XSS) vulnerability4.3 Medium
- hcltech bigfix saas, hcl software bigfix saas remediate +1 moreHCL BigFix SaaS Authentication Service is vulnerable to cache poisoning5.3 Medium
- apple music classicalThis issue was addressed with improved checks. This issue is fixed in Apple Music Classical 2.3...6.2 Medium
- hashicorp go-getter, shared library +1 moreHashiCorp go-getter Vulnerable to Arbitrary Read through Symlink Attack7.5 High
- ibm diamondback tape library firmware, storage ts4500 library, storage ts4500 library firmware +2 moreIBM TS4500 cross-site scripting5.4 Medium
- hp, inc. hp hotkey support softwareHP Hotkey Support – Escalation of Privilege8.4 High
- backstage@backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template`2.6 Low
- wulkano kapKAP 3.6.0 - TCC Bypass6.9 Medium
- msoft mflashMFlash Remote Code Execution (RCE) after authentication of a user with the "administrator" role9.1 Critical
- bunkerity bunker webBunker Web 1.6.2 - Uncontrolled external site redirect4.8 Medium
- xolluteon dropshixWordPress Dropshix plugin <= 4.0.14 - Cross Site Scripting (XSS) vulnerability7.6 High
- gopiplus vertical scroll slideshow gallery v2WordPress Vertical scroll slideshow gallery v2 plugin <= 9.1 - SQL Injection vulnerability8.8 High
- fwdesign ultimate video playerWordPress Ultimate Video Player Plugin <= 10.1 - Broken Access Control Vulnerability5.3 Medium
- withastro astro@astrojs/node's trailing slash handling causes open redirect issue5.5 Medium
- firebirdsql firebirdFirebird Non-Authorized Access to Encrypted Database Using Execute Statement on External7.1 High
- makeplane planePlane Stored XSS in Add Work Item Functionality5.4 Medium
- firebirdsql firebirdFirebird XDR Message Parsing NULL Pointer Dereference Denial-of-Service Vulnerability5.3 Medium
- autodesk autocad, advance steel, autocad architecture +7 more +9 moreDGN File Parsing Memory Corruption Vulnerability7.8 High
- autodesk autocad, advance steel, autocad architecture +7 more +9 moreDGN File Parsing Uninitialized Variable Vulnerability7.8 High
- Show moreLoading…