CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- wpbean wpb quick view for woocommerceWordPress WPB Quick View for WooCommerce plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jeremy saxey hide wp toolbarWordPress Hide WP Toolbar Plugin <= 2.7 - Broken Access Control Vulnerability4.3 Medium
- e4jvikwp vikrestaurantsWordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability7.1 High
- salesmanago & leadooWordPress SALESmanago Plugin <= 3.8.1 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- wpfactory helpdesk support ticket system for woocommerceWordPress Helpdesk Support Ticket System for WooCommerce plugin <= 2.1.1 - Broken Access Control vulnerability4.3 Medium
- salesmanago & leadooWordPress SALESmanago Plugin <= 3.8.1 - Broken Access Control Vulnerability5.3 Medium
- chad butler wp-membersWordPress WP-Members Plugin <= 3.5.4.2 - Cross Site Scripting (XSS) Vulnerability5.5 Medium
- tuyennv tz plusgalleryWordPress TZ PlusGallery Plugin <= 1.5.5 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- cardcom payment gatewayWordPress CardCom Payment Gateway plugin <= 3.5.0.7 - Broken Access Control vulnerability5.3 Medium
- radiustheme teamWordPress Team Plugin <= 5.0.6 - Broken Access Control Vulnerability4.3 Medium
- wpdesk flexible pdf invoices for woocommerce & wordpressWordPress Flexible PDF Invoices for WooCommerce & WordPress Plugin <= 6.0.13 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- powerblogservice authorsureWordPress AuthorSure Plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- themespride advanced appointment booking & schedulingWordPress Advanced Appointment Booking & Scheduling plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- tomas cordero safety exitWordPress Safety Exit Plugin <= 1.8.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- wpbean advance portfolio gridWordPress Advance Portfolio Grid plugin <= 1.07.6 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- catchsquare wp social widgetWordPress WP Social Widget Plugin <= 2.3.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- damian bp disable activation reloadedWordPress BP Disable Activation Reloaded Plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) Vulnerability6.5 Medium
- mantrabrain ultimate watermarkWordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control Vulnerability4.3 Medium
- pratik ghela makestories (for google web stories)WordPress MakeStories (for Google Web Stories) Plugin <= 3.0.4 - Server Side Request Forgery (SSRF) Vulnerability4.4 Medium
- husani wp subtitleWordPress WP Subtitle plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thimpress wp events managerWordPress WP Events Manager Plugin <= 2.2.1 - Broken Access Control Vulnerability5.3 Medium
- uncanny owl toolkit for learndashWordPress Uncanny Toolkit for LearnDash Plugin <= 3.7.0.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- brajesh singh wordpress widgets shortcodeWordPress WordPress Widgets Shortcode Plugin <= 1.0.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- claritiWordPress Clariti Plugin <= 1.2.1 - Broken Access Control Vulnerability5.4 Medium
- solwininfotech blog designerWordPress Blog Designer Plugin <= 3.1.8 - Broken Access Control Vulnerability5.4 Medium
- interserver mail baby smtpWordPress Mail Baby SMTP plugin <= 2.8 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- sayful islam upcoming events listsWordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability5.4 Medium
- benjamin pick geolocation ip detectionWordPress Geolocation IP Detection plugin <= 5.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- detheme dethemekit for elementorWordPress DethemeKit For Elementor Plugin <= 2.1.10 - Broken Access Control Vulnerability4.3 Medium
- matthewordie bucketsWordPress Buckets Plugin <= 0.3.9 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- hamid reza yazdani e-namad & shamed logo managerWordPress E-namad & Shamed Logo Manager Plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- trustpilot reviewsWordPress Trustpilot Reviews Plugin <= 2.5.925 - Broken Access Control Vulnerability4.3 Medium
- wpkoithemes wpkoi templates for elementorWordPress WPKoi Templates for Elementor Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- noumaan yaqoob compact archivesWordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- memberful - membership pluginWordPress Memberful plugin <= 1.75.0 - Broken Access Control vulnerability5.3 Medium
- milan petrovic gd bbpress toolsWordPress GD bbPress Tools Plugin <= 3.5.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- smartdatasoft dricubWordPress DriCub Theme <= 2.9 - Broken Access Control Vulnerability5.3 Medium
- javothemes javo coreWordPress Javo Core Plugin <= 3.0.0.266 - Broken Access Control Vulnerability5.3 Medium
- smartdatasoft dricubWordPress DriCub Theme <= 2.9 - Server Side Request Forgery (SSRF) Vulnerability5.4 Medium
- crm perks wp gravity forms keap/infusionsoftWordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerability4.7 Medium
- xnau webdesign participants databaseWordPress Participants Database Plugin <= 2.7.6.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- nerdpress hubbub liteWordPress Social Pug Plugin <= 1.35.2 - Sensitive Data Exposure Vulnerability4.3 Medium
- codepeople cp multi view event calendarWordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerability3.8 Low
- alex content maskWordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability6.4 Medium
- straightvisions gmbh sv proven expertWordPress SV Proven Expert Plugin <= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- alex content maskWordPress Content Mask plugin <= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerability3.8 Low
- pebas couponxxlWordPress CouponXxL Theme <= 4.5.0 - Cross Site Request Forgery (CSRF) Vulnerability8.8 High
- ays pro quiz makerWordPress Quiz Maker Plugin <= 6.7.0.65 - Sensitive Data Exposure Vulnerability5.3 Medium
- ays pro quiz makerWordPress Quiz Maker Plugin <= 6.7.0.64 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- codexpert, inc cf7 submissionsWordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability4.3 Medium
- Show moreLoading…