CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- crocoblock jetblocks for elementorWordPress JetBlocks For Elementor plugin <= 1.3.18 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetblogWordPress JetBlog plugin <= 2.4.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetsearchWordPress JetSearch plugin <= 3.5.10 - SQL Injection vulnerability9.3 Critical
- crocoblock jetsearchWordPress JetSearch plugin <= 3.5.10 - Cross Site Scripting (XSS) vulnerability7.1 High
- ultimate blocks blocksWordPress Ultimate Blocks plugin <= 3.3.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetwoobuilderWordPress JetWooBuilder plugin <= 2.1.20 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- crocoblock jetwoobuilderWordPress JetWooBuilder plugin <= 2.1.20.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- laborator kaliumWordPress Kalium theme <= 3.25 - Arbitrary Code Execution vulnerability7.2 High
- vibethemes wplms, wordpress learning management system +1 moreWordPress WPLMS plugin <= 1.9.9.7 - Broken Access Control vulnerability7.5 High
- josh kohlbach wholesale suiteWordPress Wholesale Suite plugin <= 2.2.4.2 - Privilege Escalation vulnerability7.2 High
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.11.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- etruel wpematico rss feed fetcherWordPress WPeMatico RSS Feed Fetcher plugin <= 2.8.3 - Broken Access Control vulnerability4.3 Medium
- crocoblock jetreviewsWordPress JetReviews plugin <= 3.0.0 - Local File Inclusion vulnerability7.5 High
- accessibe web accessibility by accessibeWordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerability5.4 Medium
- icegram express proWordPress Icegram Express Pro plugin <= 5.9.5 - Server Side Request Forgery (SSRF) vulnerability4.4 Medium
- multivendorxWordPress MultiVendorX plugin <= 4.2.23 - Broken Access Control vulnerability8.6 High
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.8.5 - SQL Injection vulnerability9.3 Critical
- coscheduleWordPress CoSchedule plugin <= 3.4.0 - Broken Access Control vulnerability5.3 Medium
- nks email subscription popupWordPress Email Subscription Popup plugin <= 1.2.26 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- wpinstinct woocommerce vehicle parts finderWordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - Cross Site Scripting (XSS) vulnerability7.1 High
- amentotech private limited wpguppyWordPress WPGuppy plugin <= 1.1.4 - Broken Access Control vulnerability8.2 High
- wpclever wpc countdown timer for woocommerceWordPress WPC Countdown Timer for WooCommerce plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- realmag777 mdtfWordPress MDTF plugin <= 1.3.3.9 - Broken Access Control vulnerability4.3 Medium
- stellarwp wpcompleteWordPress WPComplete plugin <= 2.9.5.3 - Broken Access Control vulnerability5.3 Medium
- bdthemes zoloblocksWordPress ZoloBlocks plugin <= 2.3.11 - Broken Access Control vulnerability5.3 Medium
- quantumcloud simple link directoryWordPress Simple Link Directory plugin < 14.8.1 - Broken Authentication vulnerability9.8 Critical
- jjlemstra whydonateWordPress Whydonate plugin <= 4.0.15 - Broken Access Control vulnerability5.3 Medium
- wpinstinct woocommerce vehicle parts finderWordPress WooCommerce Vehicle Parts Finder plugin <= 3.7 - PHP Object Injection vulnerability9.8 Critical
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.10 - SQL Injection vulnerability8.5 High
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.9 - Broken Access Control vulnerability6.3 Medium
- delucks seoWordPress DELUCKS SEO plugin <= 2.5.9 - Broken Access Control vulnerability5.3 Medium
- captcha.euWordPress Captcha.eu plugin <= 1.0.61 - Server Side Request Forgery (SSRF) vulnerability5.4 Medium
- evergreen content poster content posterWordPress Evergreen Content Poster plugin <= 1.4.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- cmssuperheroes wastiaWordPress Wastia theme < 1.1.3 - Arbitrary File Upload vulnerability10.0 Critical
- kevon adonis wp abstractsWordPress WP Abstracts plugin <= 2.7.4 - Local File Inclusion vulnerability7.5 High
- cmssuperheroes clanoraWordPress Clanora theme < 1.3.1 - Arbitrary File Upload vulnerability10.0 Critical
- code amp search & filterWordPress Search & Filter plugin <= 1.2.17 - Cross Site Request Forgery (CSRF) to Open Redirect vulnerability4.7 Medium
- ays pro survey makerWordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability7.1 High
- shiva wsanalyticsWordPress WSAnalytics plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- freshface custom cssWordPress Custom CSS plugin <= 1.4.0 - Broken Access Control vulnerability6.5 Medium
- ays pro survey makerWordPress Survey Maker plugin <= 5.1.8.8 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- calvaweb password only loginWordPress Password only login plugin <= 0.2 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- jurajpuchky fix multiple redirectsWordPress Fix Multiple Redirects plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- alexander anycommentWordPress AnyComment plugin <= 0.3.6 - SQL Injection vulnerability8.5 High
- progress planner plannerWordPress Progress Planner plugin <= 1.8.0 - Privilege Escalation vulnerability8.8 High
- somonator terms dictionaryWordPress Terms Dictionary Plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- radiustheme testimonial slider and showcase proWordPress Testimonial Slider and Showcase Pro plugin <= 2.1.7 - Local File Inclusion vulnerability7.5 High
- designthemes solar energyWordPress Solar Energy theme <= 3.5 - PHP Object Injection Vulnerability8.8 High
- designthemes insuranceWordPress Insurance theme <= 3.5 - PHP Object Injection Vulnerability8.8 High
- Show moreLoading…