CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- property hive propertyhiveWordPress PropertyHive Plugin <= 2.1.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- tickeraWordPress Tickera Plugin <= 3.5.5.6 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- wp chill gallery photoblocksWordPress Gallery PhotoBlocks Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- iulia cazan latest post shortcodeWordPress Latest Post Shortcode Plugin <= 14.0.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- buddydev mediapressWordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability7.5 High
- gdpr info cookie notice & consent banner for gdpr & ccpa complianceWordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin <= 1.7.11 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- cozythemes saaslauncherWordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability5.0 Medium
- wp delicious deliciousWordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- unknown mail mintWordPress Mail Mint Plugin <= 1.18.5 - SQL Injection Vulnerability7.6 High
- surferWordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control Vulnerability5.3 Medium
- if-so dynamic content personalization, unknown if-so dynamic content personalization +1 moreWordPress If-So Dynamic Content Personalization Plugin <= 1.9.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- radiustheme classified listingWordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability4.3 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability5.3 Medium
- tychesoftwares order delivery date for woocommerceWordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability4.3 Medium
- klarna order management for woocommerceWordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability6.6 Medium
- tomdever wpforo forumWordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability4.3 Medium
- properfraction mailoptinWordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- themefusecom brizyWordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability4.3 Medium
- themeisle orbit fox by themeisleWordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- mauticReflected XSS in lead:addLeadTags - Quick Add4.8 Medium
- mauticUser Enumeration via Response Timing5.9 Medium
- mauticSecret data extraction via elfinder5.5 Medium
- crestron touchscreens x70Privilege escalation via SCP login8.6 High
- akinsoft limondeskOTP Bypass in Akinsoft's LimonDesk8.6 High
- akinsoft limondeskXSS in Akinsoft's LimonDesk4.7 Medium
- akinsoft limondeskHost Header Injection in Akinsoft's LimonDesk7.3 High
- akinsoft limondeskiFrame Injection in Akinsoft's LimonDesk4.3 Medium
- linux, linux kernel +1 morenetfilter: nf_tables: reject duplicate device on updates7.8 High
- malcure web security malware scannerWordPress Malcure Malware Scanner plugin <= 16.8 - Broken Access Control vulnerability4.3 Medium
- sitecore experience manager (xm), experience platform (xp), experience manager +3 more +5 moreSitecore Experience Remote Code Execution through Insecure Deserialization8.8 High
- sitecore experience platform (xp), experience manager, experience platform +3 more +5 moreHTML Cache Poisoning through Unsafe Reflections9.8 Critical
- sitecore experience platform (xp), experience manager, experience platform +3 more +5 moreInformation Disclosure in ItemServices API7.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreLibsoup: improper handling of http vary header in libsoup caching5.9 Medium
- boomcmsCross-Frame Scripting (XFS) in BoomCMS2.1 Low
mungeSUSESecurity update for mungeNo score- mauticSSRF via webhook function2.7 Low
- apache dolphinschedulerApache DolphinScheduler Incorrect Default Permissions Vulnerability9.8 Critical
- akinsoft myrezztaOTP Bypass in Akinsoft's MyRezzta8.6 High
- akinsoft myrezztaAuthentication Bypass in Akinsoft's MyRezzta9.8 Critical
- akinsoft myrezztaBusiness Logic Error in Akinsoft's MyRezzta6.3 Medium
- akinsoft myrezztaXSS in Akinsoft's MyRezzta4.3 Medium
- apache dolphinschedulerApache DolphinScheduler: Alert Script Attack8.8 High
- flightphp flight, core +1 moreDenial of Service (DoS) vulnerability in mikecao/flight7.5 High
- akinsoft myrezztaIDOR in Akinsoft's MyRezzta6.8 Medium
- saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile appPost SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update4.3 Medium
- wiresharkNULL Pointer Dereference in Wireshark7.8 High
- upkeeper managerInsertion of Sensitive Information into Log File vulnerability in upKeeper Solutions upKeeper...8.8 High
- thememove makeaholicWordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability5.3 Medium
- inspirythemes realhomesWordPress RealHomes theme <= 4.3.6 - Privilege Escalation vulnerability9.8 Critical
- themehunk vayu blocks – website builder for the block editorVayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes6.4 Medium
- Show moreLoading…