CVEs published in September 2025
4,150 vulnerabilities, 293 critical, 16 exploited.
- yourplugins conditional cart messages for woocommerce – yourplugins.comWordPress Conditional Cart Messages for WooCommerce – YourPlugins.com Plugin <= 1.2.10 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- taraprasad swain htaccess ip blockerWordPress HTACCESS IP Blocker Plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- w3s cloud technology w3scloud contact form 7 to zoho crmWordPress W3SCloud Contact Form 7 to Zoho CRM plugin <= 3.2 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- honzat page manager for elementorWordPress Page Manager for Elementor Plugin <= 2.0.5 - Sensitive Data Exposure Vulnerability4.3 Medium
- wpshuffle wp subscription forms proWordPress WP Subscription Forms PRO Plugin <= 2.0.5 - Arbitrary Content Deletion Vulnerability4.3 Medium
- harutheme framesWordPress Frames Theme <= 1.5.7 - Broken Access Control Vulnerability4.3 Medium
- newsman newsmanappWordPress NewsmanApp plugin <= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- robin w bbp topic countWordPress bbp topic count plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pickplugins job board managerWordPress Job Board Manager Plugin <= 2.1.61 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- bdthemes zoloblocksWordPress ZoloBlocks Plugin <= 2.3.11 - Server Side Request Forgery (SSRF) Vulnerability5.4 Medium
- sharkthemes smart related productsWordPress Smart Related Products plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- webmaniabr nota fiscal eletrônica woocommerceWordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Broken Access Control vulnerability4.3 Medium
- webmaniabr nota fiscal eletrônica woocommerceWordPress Nota Fiscal Eletrônica WooCommerce plugin <= 3.4.0.9 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- emarket-design wp ticket customer service software & support ticket systemWordPress WP Ticket Customer Service Software & Support Ticket System Plugin <= 6.0.2 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- webandprint ar for wordpressWordPress AR For WordPress plugin <= 8.34 - Cross Site Request Forgery (CSRF) vulnerability9.6 Critical
- loopus wp virtual assistantWordPress WP Virtual Assistant Plugin <= 3.0 - Broken Access Control Vulnerability5.3 Medium
- jennifer moss mww disclaimer buttonsWordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpshuffle subscribe to unlockWordPress Subscribe To Unlock Plugin <= 1.1.5 - Local File Inclusion Vulnerability7.5 High
- wpshuffle subscribe to unlockWordPress Subscribe To Unlock Plugin <= 1.1.5 - Broken Access Control Vulnerability4.3 Medium
- wpshuffle subscribe to downloadWordPress Subscribe to Download plugin <= 2.0.9 - Local File Inclusion vulnerability7.5 High
- michael ott notelyWordPress Notely plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpshuffle subscribe to downloadWordPress Subscribe to Download plugin <= 2.0.9 - Broken Access Control vulnerability4.3 Medium
- ht plugins feedWordPress HT Feed Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- amit verma map categories to pagesWordPress Map Categories to Pages Plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- yonifre lenix scss compilerWordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- yonifre lenix scss compilerWordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- netgsmWordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerability4.3 Medium
- daganlev simple meta tagsWordPress Simple Meta Tags Plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- thetechtribe the tribalWordPress The Tribal Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- thetechtribe the tribalWordPress The Tribal Plugin <= 1.3.3 - Sensitive Data Exposure Vulnerability5.3 Medium
- joovii sendle shippingWordPress Sendle Shipping plugin <= 6.02 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- sonalsinha21 skt blocksWordPress SKT Blocks plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- galaxy weblinks post featured videoWordPress Post Featured Video Plugin <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- cartpauj user notesWordPress User Notes plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- dj-extensions.com pe easy sliderWordPress PE Easy Slider Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- wedos.com wedos globalWordPress WEDOS Global Plugin <= 1.2.2 - Broken Access Control Vulnerability5.3 Medium
- yextWordPress Yext Plugin <= 1.1.3 - Broken Access Control Vulnerability5.3 Medium
- wp delicious delishoWordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability4.3 Medium
- artistscope copysafe web protectionWordPress CopySafe Web Protection plugin <= 5.1 - Broken Access Control vulnerability5.4 Medium
- pickplugins testimonial sliderWordPress Testimonial Slider Plugin <= 3.5.8.6 - Local File Inclusion Vulnerability8.8 High
- themelooks foodbookWordPress FoodBook Plugin <= 4.7.6 - Sensitive Data Exposure Vulnerability5.3 Medium
- ryan hellyer simple colorboxWordPress Simple Colorbox Plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability6.5 Medium
- hivepress claim listingsWordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability4.3 Medium
- hivepress claim listingsWordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability4.3 Medium
- ex-themes wooeventsWordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerability5.3 Medium
- coscheduleWordPress CoSchedule Plugin <= 3.3.11 - Sensitive Data Exposure Vulnerability5.3 Medium
- wpdirectorykit wp directory kitWordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability5.3 Medium
- potenzaglobalsolutions pgs coreWordPress PGS Core Plugin <= 5.9.0 - SQL Injection Vulnerability8.5 High
- tangiblewp vehica coreWordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability4.3 Medium
- themegoods grand conference theme custom post type, grand conference +1 moreWordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerability5.4 Medium
- Show moreLoading…