CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
unic-char-propertycrates.io`unic-char-property` is unmaintainedNo scoreunic-commoncrates.io`unic-common` is unmaintainedNo scoreunic-ucd-hangulcrates.io`unic-ucd-hangul` is unmaintainedNo scoreunic-ucd-normalcrates.io`unic-ucd-normal` is unmaintainedNo scoreunic-ucdcrates.io`unic-ucd` is unmaintainedNo scoreunic-ucd-namecrates.io`unic-ucd-name` is unmaintainedNo scoreunic-char-rangecrates.io`unic-char-range` is unmaintainedNo scoreunic-segmentcrates.io`unic-segment` is unmaintainedNo scoremnlcrates.iomnl has segmentation fault and invalid memory read in `mnl::cb_run`2.0 Lownftnlcrates.iolibnftnl has Heap-based Buffer Overflow in nftnl::Batch::with_page_size (nftnl-rs)9.3 Critical- wpdreams related posts liteRelated Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- mndpsingh287 theme editorTheme Editor <= 3.0 - Cross-Site Request Forgery to Remote Code Execution8.8 High
- linuxnet: mscc: ocelot: Fix use-after-free caused by cyclic delayed workNo score
- linuxthunderbolt: Fix use-after-free in tb_dp_dprx_workNo score
- linuxscsi: mvsas: Fix use-after-free bugs in mvs_work_queueNo score
- nixdorf wincor port io driverNixdorf Wincor PORT IO Driver IOCTL wnport.sys sub_11100 stack-based overflow8.5 High
- cyberlord92 powerbi embed reportsPowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosure5.3 Medium
- kognetiks chatbot for wordpressKognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing5.3 Medium
- themeisle ppom – product addons & custom fields for woocommercePPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection7.5 High
- themeisle ppom – product addons & custom fields for woocommercePPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload9.8 Critical
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation6.5 Medium
- optimole – optimize images in real timeImage optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload4.3 Medium
- ninjateam filebird – wordpress media library folders & file managerFileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset4.3 Medium
- wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patternsGutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 5.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- themeisle redirection for contact form 7Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode6.4 Medium
- wpgmaps wp go maps (formerly wp google maps)WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning5.3 Medium
- creative-solutions-1 gspeech tts – wordpress text to speech pluginGSpeech TTS – WordPress Text To Speech Plugin <= 3.17.13 - Authenticated (Admin+) SQL injection4.9 Medium
- wpbakery page builderWPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpclever wpc smart quick view for woocommerceWPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure5.3 Medium
- stellarwp event tickets and registrationEvent Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass7.5 High
- mxp xx2wp integration toolsXX2WP Integration Tools <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpclever wpc smart wishlist for woocommerceWPC Smart Wishlist for WooCommerce <= 5.0.4 - Missing Authorization to Authenticated (Subscriber+) Information Exposure4.3 Medium
- david lingren media library assistantMedia Library Assistant <= 3.29 - Unauthenticated Limited File Read5.3 Medium
- the wikimedia foundation mediawiki - securepoll extensionStored XSS through a system message in SecurePoll6.9 Medium
- the wikimedia foundation mediawiki - cirrussearch extensionDoS vector through the cirrusbuilddoc query API6.9 Medium
- the wikimedia foundation mediawiki - growthexperiments extensionStored XSS through article extracts in GrowthExperiments6.9 Medium
- the wikimedia foundation mediawiki - growthexperiments extensionInsufficient permission checks in action=growthsetmentor6.9 Medium
- the wikimedia foundation mediawiki - centralauth extensionUserInfoCard: activeLocalBlocksAllWikis does not do permissions checks6.9 Medium
- the wikimedia foundation mediawiki - flexdiagrams extensionStored XSS through a system message in FlexDiagrams6.9 Medium
- wpdevteam gutenberg essential blocks – page builder for gutenberg blocks & patternsEssential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery6.4 Medium
- the wikimedia foundation mediawiki - cargo extensionStored XSS through wikitext in Cargo6.9 Medium
- the wikimedia foundation mediawiki - advancedsearch extensionStored XSS through system messages in AdvancedSearch6.9 Medium
- the wikimedia foundation mediawiki - uploadwizard extensionStored XSS through a system message in UploadWizard6.9 Medium
- the wikimedia foundation mediawiki - imagerating extensionStored XSS through a system message in ImageRating6.9 Medium
- wikimedia foundation mediawiki - skin:blueskyStored XSS through system messages in Skin:BlueSky6.9 Medium
- metagauss registrationmagic, registrationmagic – custom registration forms, user registration, payment, and user login +1 moreRegistrationMagic - Custom Registration Forms <= 3.7.9.2 - PHP Object Injection9.8 Critical
- cloughit async javascriptAsync JavaScript <= 2.19.07.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- dan coulter flickr galleryFlickr Gallery <= 1.5.2 - Unauthenticated PHP Object Injection9.8 Critical
- wpmudev appointmentsAppointments <= 2.2.1 - Unauthenticated PHP Object Injection9.8 Critical
- shortpixel image optimizer – optimize images, convert webp & avifShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export5.4 Medium
- Show moreLoading…