CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- wp travel engine travel engineWordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS Plugin <= 3.6.20 - Race Condition Vulnerability4.3 Medium
- vw themes ibtanaWordPress Ibtana Plugin <= 1.2.5.3 - Arbitrary Content Deletion Vulnerability6.5 Medium
- pencidesign penci filter everythingWordPress Penci Filter Everything Plugin < 1.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- darren cooney ajax load moreWordPress Ajax Load More Plugin <= 7.6.0.2 - Sensitive Data Exposure Vulnerability5.3 Medium
- pencidesign penci podcastWordPress Penci Podcast Plugin <= 1.6 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- pencidesign penci recipeWordPress Penci Recipe Plugin <= 4.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- pencidesign penci shortcodes & performanceWordPress Penci Shortcodes & Performance Plugin < 6.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- pencidesign penci portfolioWordPress Penci Portfolio Plugin <= 3.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- pencidesign soledadWordPress Soledad Theme <= 8.6.8 - Local File Inclusion Vulnerability7.5 High
- david lingren media library assistantWordPress Media Library Assistant Plugin <= 3.28 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- pencidesign soledadWordPress Soledad Theme <= 8.6.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- advancedcoding wpdiscuzWordPress wpDiscuz Plugin <= 7.6.33 - Broken Access Control Vulnerability4.3 Medium
- fernando acosta make column clickable elementorWordPress Make Column Clickable Elementor Plugin <= 1.6.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- pluginwale easy pricing table wpWordPress Easy Pricing Table WP Plugin <= 1.1.3 - Local File Inclusion Vulnerability7.5 High
- barry event rocketWordPress Event Rocket Plugin <= 3.3 - Broken Access Control Vulnerability4.3 Medium
- rustaurius ultimate wp mailWordPress Ultimate WP Mail Plugin <= 1.3.8 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- mihdan mihdan: no external linksWordPress Mihdan: No External Links Plugin <= 5.1.6.2 - Cross Site Request Forgery (CSRF) Vulnerability5.4 Medium
- cashbill cashbill.pl – płatności woocommerceWordPress CashBill.pl – Płatności WooCommerce Plugin <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- activewebsight seo backlink monitorWordPress SEO Backlink Monitor plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- davaxi goracashWordPress Goracash Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- activewebsight seo backlink monitorWordPress SEO Backlink Monitor plugin <= 1.8.0 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- ibm sterling connect:express for microsoft windows, sterling connect\ +1 moreIBM Sterling Connect:Express for Microsoft Windows information disclosure5.9 Medium
- binsaifullah beafWordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability4.4 Medium
- syed balkhi affiliatewp – external referral linksWordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- sapo feedWordPress SAPO Feed plugin <= 2.4.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- ht plugins mega – absolute addons for wpbakery page builderWordPress HT Mega – Absolute Addons for WPBakery Page Builder Plugin <= 1.0.9 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- raoinfotech gsheets connectorWordPress GSheets Connector Plugin <= 1.1.1 - PHP Object Injection Vulnerability7.2 High
- ironikus wp mailto linksWordPress WP Mailto Links Plugin <= 3.1.4 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- codesolz better find and replaceWordPress Better Find and Replace Plugin <= 1.7.6 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- webvitaly login-logoutWordPress Login-Logout Plugin <= 3.8 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- mortgage calculator bmi adult & kid calculatorWordPress BMI Adult & Kid Calculator Plugin <= 1.2.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- gopiplus@hotmail.com wp tabber widgetWordPress Wp tabber widget Plugin <= 4.0 - SQL Injection Vulnerability8.5 High
- delucks seoWordPress DELUCKS SEO Plugin <= 2.7.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- jose vega wp frontend adminWordPress WP Frontend Admin plugin <= 1.22.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ataur r gutenkitWordPress GutenKit Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- aresit wp compressWordPress WP Compress Plugin <= 6.50.54 - Broken Access Control Vulnerability5.3 Medium
- md taufiqur rahman ris version switcher – downgrade or upgrade wp versions easilyWordPress RIS Version Switcher – Downgrade or Upgrade WP Versions Easily Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability6.5 Medium
- wp-experts.in sales count manager for woocommerceWordPress Sales Count Manager for WooCommerce plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpsuperiors developer woocommerce additional fees on checkout (free)WordPress WooCommerce Additional Fees On Checkout (Free) plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- amin y agreeme checkboxes for woocommerceWordPress AgreeMe Checkboxes For WooCommerce Plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- epeken all kurirWordPress Epeken All Kurir plugin <= 2.0.6 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- prowcplugins product time countdown for woocommerceWordPress Product Time Countdown for WooCommerce plugin <= 1.6.5 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- heureka group heurekaWordPress Heureka Plugin <= 1.1.0 - Broken Access Control Vulnerability5.3 Medium
- rouergue création editor custom color paletteWordPress Editor Custom Color Palette plugin <= 3.5.6 - Broken Access Control vulnerability6.5 Medium
- anyclip video platform luminous studioWordPress AnyClip Luminous Studio Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- dialogity free live chatWordPress Dialogity Free Live Chat plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpfactory advertsWordPress Adverts Plugin <= 1.4 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- eleopard behance portfolio managerWordPress Behance Portfolio Manager plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- césar martín tochat.beWordPress TOCHAT.BE Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- Show moreLoading…