CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- matat technologies deliver via shipos for woocommerceWordPress Deliver via Shipos for WooCommerce plugin <= 3.0.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- nurul amin wp system informationWordPress WP System Information Plugin <= 1.5 - Sensitive Data Exposure Vulnerability4.3 Medium
- printcart web to print product designer for woocommerceWordPress Printcart Web to Print Product Designer for WooCommerce plugin <= 2.4.8 - Broken Access Control vulnerability4.3 Medium
- conveythisWordPress ConveyThis plugin <= 269.1 - PHP Object Injection vulnerability7.2 High
- era404 linkedincludeWordPress LinkedInclude Plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- ck macleod category featured images extendedWordPress Category Featured Images Extended Plugin <= 1.52 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- n-media frontend file managerWordPress Frontend File Manager plugin <= 23.3 - Broken Access Control vulnerability5.3 Medium
- coordinadora mercantil s.a. envíos coordinadora woocommerceWordPress Envíos Coordinadora Woocommerce plugin <= 1.1.32 - Sensitive Data Exposure vulnerability5.3 Medium
- automattic developerWordPress Developer Plugin <= 1.2.6 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- ideal postcodes uk address postcode validationWordPress UK Address Postcode Validation plugin <= 3.9.2 - Sensitive Data Exposure vulnerability5.3 Medium
- immonex kickstart teamWordPress immonex Kickstart Team Plugin <= 1.6.9 - Local File Inclusion Vulnerability7.5 High
- wp chill passsterWordPress Passster Plugin <= 4.2.18 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.3 - Content Injection vulnerability5.3 Medium
- stephanie leary dashboard notepadWordPress Dashboard Notepad Plugin <= 1.42 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- kanwei doublethedonation double the donationWordPress Double the Donation Plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- kanwei doublethedonation double the donationWordPress Double the Donation Plugin <= 2.0.0 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- piotnetdotcom piotnet formsWordPress Piotnet Forms Plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- diego pereira powerfolioWordPress PowerFolio Plugin <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- aurélien lws lws affiliationWordPress LWS Affiliation Plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- ricky dawn bot block – stop spam referrals in google analyticsWordPress Bot Block – Stop Spam Referrals in Google Analytics Plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- etruel wpematico rss feed fetcherWordPress WPeMatico RSS Feed Fetcher Plugin <= 2.8.10 - Sensitive Data Exposure Vulnerability4.3 Medium
- meitar subresource integrity (sri) managerWordPress Subresource Integrity (SRI) Manager Plugin <= 0.4.0 - Broken Access Control Vulnerability4.3 Medium
- themewant easy hotel bookingWordPress Easy Hotel Booking plugin <= 1.9.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- suresh kumar mukhiya append extensions on pagesWordPress Append extensions on Pages Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- blocksera image hover effects – elementor addonWordPress Image Hover Effects – Elementor Addon Plugin <= 1.4.4 - Broken Access Control Vulnerability5.3 Medium
- jonathanmh append link on copyWordPress Append Link on Copy Plugin <= 0.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- andy moyle emergency password resetWordPress Emergency Password Reset plugin <= 9.3 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- skimlinks affiliate marketing toolWordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3 - Broken Access Control vulnerability5.3 Medium
- skimlinks affiliate marketing toolWordPress Skimlinks Affiliate Marketing Tool plugin <= 1.3.1 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- cedcommerce wp advanced pdfWordPress WP Advanced PDF Plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- ays pro photo gallery by aysWordPress Photo Gallery by Ays Plugin <= 6.3.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- loc bui payosWordPress payOS plugin <= 1.0.73 - Cross Site Request Forgery (CSRF) vulnerability5.4 Medium
- e-plugins directory proWordPress Directory Pro Plugin <= 2.5.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- glen scott plugin security scannerWordPress Plugin Security Scanner Plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- oggix ongkoskirim.idWordPress Ongkoskirim.id Plugin <= 1.0.6 - Broken Access Control Vulnerability5.4 Medium
- ken107 sitenarrator text-to-speech widgetWordPress SiteNarrator Text-to-Speech Widget Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- icopydoc maps for wpWordPress Maps for WP Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- ays pro poll makerWordPress Poll Maker Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- 100plugins open user mapWordPress Open User Map Plugin <= 1.4.14 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- plugin devs post carousel slider for elementorWordPress Post Carousel Slider for Elementor Plugin <= 1.7.0 - Broken Access Control Vulnerability6.5 Medium
- wpcraft woomsWordPress WooMS Plugin <= 9.12 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- wpcraft woomsWordPress WooMS Plugin <= 9.12 - Broken Access Control Vulnerability5.3 Medium
- tmatsuur slightly troublesome permalinkWordPress Slightly troublesome permalink Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- travelmap travel mapWordPress Travel Map Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- e4jvikwp vikrestaurantsWordPress VikRestaurants Table Reservations and Take-Away plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- codexpert, inc codesignerWordPress CoDesigner plugin <= 4.29 - Broken Access Control vulnerability4.3 Medium
- zoho subscriptions billingWordPress Zoho Billing Plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- photonicgnostic library bookshelvesWordPress Library Bookshelves Plugin <= 5.11 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- ghozylab gallery lightboxWordPress Gallery Lightbox plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wp codeus proposalsWordPress WP Proposals Plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- Show moreLoading…