CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- instapagedev instapage pluginWordPress Instapage plugin plugin <= 3.7.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- yaycommerce yaycurrencyWordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability6.6 Medium
- grooni groovy menuWordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- smub athemes addons for elementorWordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- javothemes javo coreWordPress Javo Core Plugin <= 3.0.0.266 - Cross Site Request Forgery (CSRF) Vulnerability8.8 High
- lambertgroup allinone - banner rotatorWordPress AllInOne - Banner Rotator Plugin <= 3.8 - SQL Injection Vulnerability8.5 High
- lambertgroup - allinone - content sliderWordPress LambertGroup - AllInOne - Content Slider Plugin <= 3.8 - SQL Injection Vulnerability8.5 High
- lambertgroup - allinone - banner with thumbnailsWordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin <= 3.8 - SQL Injection Vulnerability8.5 High
- lambertgroup - allinone - banner with playlistWordPress LambertGroup - AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection Vulnerability8.5 High
- roxnor emailkitWordPress EmailKit Plugin <= 1.6.0 - Arbitrary Content Deletion Vulnerability4.9 Medium
- metaphorcreations dittyWordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- jordy meow gallery custom linksWordPress Gallery Custom Links Plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- cridiostudio listingproWordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerability5.4 Medium
- syam mohan wpfront user role editorWordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- awsm.in embed any documentWordPress Embed Any Document Plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- 8theme xstoreWordPress XStore theme < 9.6 - Content Injection vulnerability5.3 Medium
- duongancol woostifyWordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- jeff farthing theme my loginWordPress Theme My Login Plugin <= 7.1.12 - Broken Access Control Vulnerability6.5 Medium
- codexthemes thegemWordPress TheGem Theme <= 5.10.5 - Broken Access Control Vulnerability5.4 Medium
- codexthemes thegem (elementor)WordPress TheGem (Elementor) Theme <= 5.10.5 - Broken Access Control Vulnerability5.4 Medium
- benjamin intal stackableWordPress Stackable Plugin <= 3.18.1 - Sensitive Data Exposure Vulnerability4.3 Medium
- benjamin intal stackableWordPress Stackable Plugin <= 3.18.1 - Broken Access Control Vulnerability4.3 Medium
- codename065 download managerWordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- codename065 download managerWordPress Download Manager Plugin <= 3.3.25 - Sensitive Data Exposure Vulnerability5.3 Medium
- fkrauthan wp-mpdfWordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- metagauss profilegridWordPress ProfileGrid plugin <= 5.9.5.7 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- themeplugs authorsyWordPress Authorsy Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- undsgn uncodeWordPress Uncode theme < 2.9.4.4 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- di themes demo site importerWordPress Di Themes Demo Site Importer plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Plugin Activation vulnerability4.3 Medium
- acclectic media organizerWordPress Acclectic Media Organizer Plugin <= 1.4 - Broken Access Control Vulnerability6.5 Medium
- guihom wide bannerWordPress Wide Banner plugin <= 1.0.4 - Broken Access Control vulnerability5.3 Medium
- nick verwymeren quantities and units for woocommerceWordPress Quantities and Units for WooCommerce plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- hclsoftware travelerWordPress Traveler theme < 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- seatheme bm content builderWordPress BM Content Builder Plugin < 3.16.3.3 - Arbitrary File Deletion Vulnerability7.7 High
- maciej bis permalink manager liteWordPress Permalink Manager Lite Plugin <= 2.5.1.3 - Sensitive Data Exposure Vulnerability7.5 High
- hclsoftware travelerWordPress Traveler Theme < 3.2.3 - Arbitrary Content Deletion Vulnerability7.5 High
- wso2 enterprise integrator, identity server, identity server as key manager +1 more +3 moreAuthenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution6.7 Medium
- wso2 identity server, identity server as key manager, open banking iam +2 moreUsername Enumeration in Multiple WSO2 Products with Multi-Attribute Login Enabled3.7 Low
- apache airflowApache Airflow: Connection sensitive details exposed to users with READ permissions6.5 Medium
- unitree g1, go2, b2 firmware +3 more +5 moreUnitree Multiple Robotic Products Command Injection7.3 High
- dylanjkotze zephyr project managerZephyr Project Manager <= 3.3.202 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- jhoppe markdown shortcodeMarkdown Shortcode <= 0.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- douglaskarr tweetthis shortcodeTweetThis Shortcode <= 1.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- softaculous backuply – backup, restore, migrate and cloneBackuply – Backup, Restore, Migrate and Clone <= 1.4.8 - Authenticated (Admin+) Arbitrary File Deletion6.5 Medium
- inc2734 snow monkeySnow Monkey <= 29.1.5 - Unauthenticated Blind Server-Side Request Forgery5.4 Medium
- danieliser popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builderPopup Maker <= 1.20.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title Parameter6.4 Medium
- gamerz wp-downloadmanagerWP-DownloadManager <= 1.68.11 - Authenticated (Admin+) Arbitrary File Upload7.2 High
- marceljm featured image from url (fifu)Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File5.3 Medium
- marceljm featured image from url (fifu)Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Admin+) SQL Injection4.9 Medium
- marceljm featured image from url (fifu)Featured Image from URL (FIFU) <= 5.2.7 - Missing Authorization to Password Protected Post Disclosure5.3 Medium
- Show moreLoading…