CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- exlac tablegen – data table generatorTableGen – Data Table Generator <= 1.3.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- piupiiu a simple multilanguage pluginA Simple Multilanguage Plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- bdevs generic elementsGeneric Elements <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- aryadhiratara optimize more! – cssOptimize More! – CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset4.3 Medium
- backupbolt backup boltBackup Bolt <= 1.4.1 - Authenticated (Admin+) Arbitrary File Download3.8 Low
- muhammad-rehman wp photo effectsWP Photo Effects <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- webdevabq mobile site redirectMobile Site Redirect <= 1.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- ultrapressorg ultra addons lite for elementorUltra Addons Lite for Elementor <= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Animated Text Field6.4 Medium
- inforrada ird sliderIrd Slider <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- clickanatomy interactive human anatomy with clickable body partsInteractive Medical Drawing of Human Body <= 2.6 - Authenticated (Admin+) Stored Cross-Site Scripting5.5 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion9.8 Critical
- ticketspot event tickets, rsvps, calendarEvent Tickets, RSVPs, Calendar <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hancock11 appy pie connect for woocommerceAppy Pie Connect for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via reset_user_password9.8 Critical
- gopi plus wp cycle text announcementWp cycle text announcement <= 8.1 - Authenticated (Contributor+) SQL Injection6.5 Medium
- laudanumsoft mpwizard – create mercado pago payment linksMPWizard – Create Mercado Pago Payment Links <= 1.2.1 - Cross-Site Request Forgery to Arbitrary Post Deletion4.3 Medium
- magnigenie restropress – online food ordering systemRestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2 - Unauthenticated Information Exposure to Authentication Bypass via Forged JWT9.8 Critical
- ibachal smart docsSmart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting5.5 Medium
- codeclouds unifyUnify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode6.4 Medium
- quantumrose wprecoveryWPRecovery <= 2.0 - Unauthenticated SQL Injection to Arbitrary File Deletion9.1 Critical
- tom riddle comment info detectorComment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update4.3 Medium
- hashthemes easy elementor addons – addons pack for elementor page builderEasy Elementor Addons <= 2.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sitealert (formerly wp health)SiteAlert (Formerly WP Health) <= 1.9.8 - Missing Authorization to Unauthenticated Site Health Information Exposure5.3 Medium
- textbuilderTextBuilder 1.0.0 - 1.1.1 - Cross-Site Request Forgery to Privilege Escalation via Account Takeover8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +13 more +15 moreQemu-kvm: vnc websocket handshake use-after-free7.5 High
- talemy spirit frameworkSpirit Framework <= 1.2.14 - Authentication Bypass to Account Takeover and Privilege Escalation9.8 Critical
- teknolojik center telecommunication industry trade co. ltd. b2b - netsis panelSQLi in Teknolojik Center Telecommunication's B2B - Netsis Panel8.2 High
- panasonic autodownloaderInstaller of Panasonic AutoDownloader version 1.2.8 contains an issue with the DLL...8.4 High
- anysphere cursorCursor: Potential Information Leakage via Mermaid Diagram5.9 Medium
- anthropic claude code, anthropics claude-code +1 moreClaude Code's startup trust dialog could lead to Command Execution attack8.7 High
- emlogEmlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input5.1 Medium
- emlogEmlog Pro is vulnerable to stored XSS attack through HTML template injection7.6 High
- delta electronics diascreenFile Parsing Out-Of-Bounds Write Vulnerability in DIAScreen6.8 Medium
- delta electronics diascreenFile Parsing Out-Of-Bounds Write Vulnerability in DIAScreen6.8 Medium
- delta electronics diascreenFile Parsing Out-Of-Bounds Write Vulnerability in DIAScreen6.8 Medium
- delta electronics diascreenFile Parsing Out-Of-Bounds Write Vulnerability in DIAScreen6.8 Medium
- No product listedYoast SEO Premium 25.7-25.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- motioneye project motioneyeDuplicate Advisory: motionEye vulnerable to RCE via unsanitized motion config parameter7.2 High
- metinfoA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0....6.1 Medium
- metinfoA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0....6.1 Medium
- metinfoA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0....6.1 Medium
- metinfoA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0....6.1 Medium
- metinfoA stored Cross-Site Scripting (XSS) vulnerability has been discovered in MetInfo CMS version 8.0....6.1 Medium
- seacmsAn information disclosure vulnerability has been discovered in SeaCMS 13.1. The vulnerability...4.9 Medium
- emlogA stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The...6.1 Medium
- emlogA stored Cross-Site Scripting (XSS) vulnerability has been discovered in Emlog Pro 2.5.19. The...5.9 Medium
- xunruicmsA stored Cross-Site Scripting (XSS) vulnerability has been discovered in XunRuiCMS version 4.7.1....6.1 Medium
- unity editor, unity3d unity editor +1 moreUnity Editor 2019.1 through 6000.3 could allow remote attackers to exploit file loading and Local...7.4 High
- No product listedA SQL injection vulnerability was discovered in the /articles endpoint of MyClub 0.5, affecting...6.5 Medium
- directadminAn issue in DirectAdmin v1.680 allows unauthorized attackers to manipulate the page layout and...8.2 High
- tcl 65c655 firmwareA TCL Smart TV running a vulnerable UPnP/DLNA MediaRenderer implementation is affected by a...7.5 High
- Show moreLoading…