CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- search atlas seo, search atlas group atlas seo +1 moreWordPress Search Atlas SEO Plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- richard leishman mail subscribe listWordPress Mail Subscribe List Plugin <= 2.1.10 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- jeroen schmit theater for wordpressWordPress Theater for WordPress plugin <= 0.18.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- maxpagels shortcodeWordPress ShortCode Plugin <= 0.8.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- douglaskarr list child pages shortcodeWordPress List Child Pages Shortcode Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- akdevs genealogical treeWordPress Genealogical Tree plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- termageddon termageddon: cookie consent & privacy complianceWordPress Termageddon: Cookie Consent & Privacy Compliance Plugin <= 1.8.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- averta master sliderWordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- wpo-hr ngg smart image searchWordPress NGG Smart Image Search Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- aum watcharapon designil pdpa thailandWordPress Designil PDPA Thailand plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webvitaly page-listWordPress Page-list Plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- sumit singh classic widgets with block-based widgetsWordPress Classic Widgets with Block-based Widgets Plugin <= 1.0.1 - Broken Access Control Vulnerability5.3 Medium
- nextendweb nextend facebook connectWordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- leeshadle draftWordPress Draft Plugin <= 3.0.9 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- bytes.co wp compilerWordPress WP Compiler Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- fastlyWordPress Fastly plugin <= 1.2.28 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- bage flexible faqWordPress Flexible FAQ Plugin <= 0.2 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- techeshta card elements for wpbakeryWordPress Card Elements for WPBakery Plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- lije show pages listWordPress Show Pages List Plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- ontraport pilotpressWordPress PilotPress Plugin <= 2.0.36 - Broken Access Control Vulnerability4.3 Medium
- dynamic web lab team managerWordPress Team Manager plugin <= 2.6.8 - Broken Access Control vulnerability5.3 Medium
- printeers print & shipWordPress Printeers Print & Ship Plugin <= 1.17.0 - Cross Site Request Forgery (CSRF) Vulnerability5.4 Medium
- chris taylor voucherpressWordPress VoucherPress Plugin <= 1.5.7 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- iberezansky 3d flipbook – pdf flipbook viewer, flipbook image galleryWordPress 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Plugin <= 1.16.16 - Sensitive Data Exposure Vulnerability5.3 Medium
- shapedplugin quick view for woocommerceWordPress Quick View for WooCommerce Plugin <= 2.2.16 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- alexander lueken podlove subscribe buttonWordPress Podlove Subscribe button Plugin <= 1.3.11 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- webvitaly sitekitWordPress Sitekit Plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- bdthemes zoloblocksWordPress ZoloBlocks plugin <= 2.3.12 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bitlydeveloper bitlyWordPress Bitly plugin <= 2.8.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- guaven labs sql chart builderWordPress SQL Chart Builder Plugin <= 2.3.7.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- ickata image editor by pixoWordPress Image Editor by Pixo Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- joomsky js job managerWordPress JS Job Manager Plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- mayo moriyama force update translationsWordPress Force Update Translations plugin <= 0.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- rustaurius front end usersWordPress Front End Users plugin <= 3.2.35 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- niaj morshed lc wizardWordPress LC Wizard plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- chandrika sista wp category dropdownWordPress WP Category Dropdown Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- ontraport pilotpressWordPress PilotPress Plugin <= 2.0.36 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- michel - xiligroup dev xili-tidy-tagsWordPress xili-tidy-tags Plugin <= 1.12.06 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- snapwidget social photo feed widgetWordPress SnapWidget Social Photo Feed Widget Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- vadim bogaiskov bg church memosWordPress Bg Church Memos Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- bestweblayout portfolioWordPress Portfolio Plugin <= 2.58 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- anps constructoWordPress Constructo Theme <= 4.3.9 - Cross Site Request Forgery (CSRF) Vulnerability8.8 High
- templateinvaders ti woocommerce wishlistWordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability5.3 Medium
- themeum qubelyWordPress Qubely Plugin <= 1.8.14 - Sensitive Data Exposure Vulnerability4.3 Medium
- codefish pinterest pinboard widgetWordPress Pinterest Pinboard Widget Plugin <= 1.0.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- apustheme findgoWordPress Findgo Theme <= 1.3.55 - Cross Site Request Forgery (CSRF) Vulnerability8.8 High
- posimyth sticky header effects for elementorWordPress Sticky Header Effects for Elementor Plugin <= 2.1.2 - Broken Access Control Vulnerability4.3 Medium
- rameez iqbal real estate managerWordPress Real Estate Manager Plugin <= 7.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- jetmonsters getwidWordPress Getwid Plugin <= 2.1.2 - Sensitive Data Exposure Vulnerability4.3 Medium
- Show moreLoading…