CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- pickplugins job board managerWordPress Job Board Manager Plugin <= 2.1.61 - Content Injection Vulnerability3.8 Low
- eric mann wp publication archiveWordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- habibur rahman comment form wp – customize default comment formWordPress Comment Form WP – Customize Default Comment Form plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- priyanshumittal shk corporateWordPress Shk Corporate Theme <= 2.4.1.1 - Broken Access Control Vulnerability4.3 Medium
- the african boss get cashWordPress Get Cash plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mndpsingh287 wp mailWordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- wpdever wp notification bellWordPress WP Notification Bell plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- themepoints carousel ultimateWordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- creedally bulk featured imageWordPress Bulk Featured Image plugin <= 1.2.4 - Arbitrary File Upload vulnerability9.1 Critical
- swiftninjapro developer tools blockerWordPress Developer Tools Blocker Plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability5.4 Medium
- desertthemes softmeWordPress SoftMe Theme <= 1.1.27 - Broken Access Control Vulnerability4.3 Medium
- plugin devs product carousel slider for elementorWordPress Product Carousel Slider for Elementor Plugin <= 2.1.3 - Broken Access Control Vulnerability3.5 Low
- rubel miah aitasi coming soonWordPress Aitasi Coming Soon Plugin <= 2.0.2 - Deserialization of untrusted data Vulnerability7.2 High
- ram ratan maurya stagtoolsWordPress Stagtools Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- themearile consultstreetWordPress Consultstreet Theme <= 3.0.0 - Broken Access Control Vulnerability4.3 Medium
- pricelisto best restaurant menu by pricelistoWordPress Best Restaurant Menu by PriceListo Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- wp codeus ultimate client dashWordPress Ultimate Client Dash Plugin <= 4.7 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- jimmywb simple link list widgetWordPress Simple Link List Widget Plugin <= 0.3.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- nick ciske to lead for salesforceWordPress To Lead For Salesforce Plugin <= 2.7.3.9 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- babar prettyphotoWordPress prettyPhoto Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- dsingh purge varnish cacheWordPress Purge Varnish Cache Plugin <= 2.6 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- imjoehaines wordpress error monitoring by bugsnagWordPress WordPress Error Monitoring by Bugsnag Plugin <= 1.6.3 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- otwthemes widgetize pages lightWordPress Widgetize Pages Light Plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- brijrajs woocommerce single page checkoutWordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- michalzagdan trustmate.io – woocommerce integrationWordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- kcs responderWordPress Responder Plugin <= 4.3.8 - Cross Site Request Forgery (CSRF) Vulnerability5.4 Medium
- steve truman wp email templateWordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- themelocation custom woocommerce checkout fields editorWordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- bjorn manintveld bcm duplicate menuWordPress BCM Duplicate Menu plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- mahmudul hasan arif ninja chartsWordPress Ninja Charts plugin <= 3.3.5 - Sensitive Data Exposure vulnerability5.3 Medium
- dudaster elementor element conditionWordPress Elementor Element Condition Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- payoneer checkout checkoutWordPress Payoneer Checkout Plugin <= 3.4.0 - Content Spoofing Vulnerability4.3 Medium
- rainafarai notification for telegramWordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- wpbean wpb elementor addonsWordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpkube authors listWordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- arjan olsder seo auto linkerWordPress SEO Auto Linker Plugin <= 1.5.3 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- wpkube kiwiWordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- themeisle wp full stripe freeWordPress WP Full Stripe Free Plugin <= 8.2.5 - SQL Injection Vulnerability7.6 High
- saad iqbal license manager for woocommerceWordPress License Manager for WooCommerce Plugin <= 3.0.12 - SQL Injection Vulnerability7.6 High
- themifyme themify popupWordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- vw themes ibtana – ecommerce product addonsWordPress Ibtana – Ecommerce Product Addons plugin <= 0.4.7.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jbhovik ray enterprise translationWordPress Ray Enterprise Translation plugin <= 1.7.2 - Broken Access Control vulnerability5.4 Medium
- arisoft ari fancy lightboxWordPress ARI Fancy Lightbox Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- gutentorWordPress Gutentor plugin <= 3.5.5 - Broken Access Control vulnerability4.3 Medium
- netcad netgis serverReflected XSS in Netcad Software's NetGIS Server5.4 Medium
- amd epyc™ 7003 series processors, epyc™ 8004 series processors, epyc™ 9004 series processors +17 more +19 moreIncomplete cleanup after loading a CPU microcode patch may allow a privileged attacker to degrade...3.2 Low
fxhashcrates.iofxhash - no longer maintainedNo scoreadlercrates.ioadler crate is unmaintained, use adler2 insteadNo score- huawei harmonyosRace condition vulnerability in the device standby module. Impact: Successful exploitation of...5.1 Medium
- huawei harmonyosRace condition vulnerability in the audio module. Impact: Successful exploitation of this...7.5 High
- Show moreLoading…