CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- mdimran41 blog designer for elementor – post slider, post carousel, post gridBlog Designer For Elementor – Post Slider, Post Carousel, Post Grid <= 1.1.7 - Cross-Site Request Forgery4.3 Medium
- bessermitfahren mitfahrgelegenheitMitfahrgelegenheit <= 1.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via date Parameter6.4 Medium
- natata7 mixtapeMixtape <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- izem run logRun Log <= 1.7.10 - Cross-Site Request Forgery to Settings Update4.3 Medium
- wordpresschef salon booking system – free versionSalon Booking System <= 10.22 - Missing Authorization to Unauthenticated AJAX Actions Execution5.3 Medium
- webcodingplace ultimate classified listingsUltimate Classified Listings <= 1.6 - Authenticated (Contributor+) Local File Inclusion7.5 High
- ishan001 analytics reduce bounce rateAnalytics Reduce Bounce Rate <= 2.3 - Cross-Site Request Forgery4.3 Medium
- jegerwan plugin updates blockerPlugin updates blocker <= 0.2 - Cross-Site Request Forgery4.3 Medium
- mythemeshop my wp translateMy WP Translate <= 1.1 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Option Read and Deletion5.4 Medium
- astoundify jobifyJobify <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via keyword Parameter6.4 Medium
- maheshmthorat all in one minifierAll in one Minifier <= 3.2 - Unauthenticated SQL Injection7.5 High
- kamilkhan coupon apiCoupon API <= 6.2.12 - Authenticated (Administrator+) SQL Injection via 'log_duration'4.9 Medium
- shaikhaezaz80 countdown timer for elementorCountdown Timer for Elementor <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'countdown_label'6.4 Medium
- fassionstorage propovoice: all-in-one client management systemPropovoice <= 1.7.6.7 - Unauthenticated Arbitrary File Read7.5 High
- idiatech catalog importer, scraper & crawlerCatalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection8.1 High
- rejuancse digital events calendarDigital Events Calendar <= 1.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via column Parameter6.4 Medium
- livingos themeloom widgetsThemeLoom Widgets <= 1.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- eveniumEvenium <= 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- jh5ru the integration of the amo.crmThe integration of the AMO.CRM <= 1.0.1 - Cross-Site Request Forgery4.3 Medium
- wen-solutions wp easy faqsWP Easy FAQs <= 1.0.5 - Authenticated (Author+) Stored Cross-Site Scripting via WP_EASY_FAQ Shortcode6.4 Medium
- webcodingplace ultimate classified listingsUltimate Classified Listings <= 1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- gyaku autocatsetAutoCatSet <= 2.1.4 - Cross-Site Request Forgery4.3 Medium
- miriamgoldman workable apiWorkable API <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via workable_jobs Shortcode6.4 Medium
- moreirapontocom certifica wpCertifica WP <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via evento Parameter6.4 Medium
- zohoflow zoho flow – integrate 100+ plugins with 1000+ business apps, no-code workflow automationZoho Flow <= 2.14.1 - Cross-Site Request Forgery4.3 Medium
- unknown wp edit password protectedWp Edit Password Protected < 1.3.5 - Open Redirect6.1 Medium
- ketr jepaasJEPaaS Filter doFilterInternal access control5.3 Medium
- broadcom 8.6.it management suiteElevation of Privileges Vulnerability in IT Management Suite8.8 High
- lokibhardwaj php-code-for-unlimited-file-uploadlokibhardwaj PHP-Code-For-Unlimited-File-Upload f.php cross site scripting5.1 Medium
jsondiffpatchnpm,@rootio/jsondiffpatchRoot +1 morejsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin2.3 Low- catfolders – wordpress media library folders & categoriesCatFolders – Tame Your WordPress Media Library by Category <= 2.5.2 - Authenticated (Author+) SQL Injection via CSV Import6.5 Medium
- display painéis tgaDisplay Painéis TGA Galeria rename path traversal4.8 Medium
- binary-husky gpt academicbinary-husky gpt_academic LaTeX File latex_toolbox.py merge_tex_files_ path traversal5.3 Medium
- danny-avila danny-avila/librechat, librechat +1 moreImproper Authorization in danny-avila/librechat4.2 Medium
- scada-ltsScada-LTS Reports reports.shtm cross site scripting4.8 Medium
- openprinting cupscups: Remote DoS via null dereference6.5 Medium
- xenMutiple vulnerabilities in the Viridian interface9.8 Critical
- openprinting cupscups has Authentication bypass with AuthType Negotiate8.0 High
- intelliants subrion cmsSubrion CMS: Authenticated administrators are able to gain escalated access through Run SQL Query tool3.8 Low
- xenMutiple vulnerabilities in the Viridian interface9.8 Critical
- scada-ltsScada-LTS Data Point Edit data_point_edit.shtm cross site scripting4.8 Medium
- kalcaddle kodboxkalcaddle kodbox editor.class.php fileSave path traversal5.3 Medium
- No product listed299ko FileManagerAPIController.php delete path traversal5.3 Medium
- No product listedFreshwork logout redirect5.3 Medium
- lostvip ruoyi-golostvip-com ruoyi-go Background Management SysRoleDao.go SelectListPage sql injection5.3 Medium
- No product listedGrandNode Voucher ConfirmOrder race condition2.1 Low
shopware/corePackagist,shopware/shopwarePackagist +1 moreShopware: Reflective Cross Site-Scripting (XSS) in CMS components8.8 Highxml2rfcPyPIxml2rfc is vulnerable to arbitrary file reads through prepped files8.7 High- angularAngular SSR: Global Platform Injector Race Condition Leads to Cross-Request Data Leakage7.1 High
- ibm security verify information queueIBM Security Verify Information Queue information disclosure5.9 Medium
- Show moreLoading…