CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- themepoints tab ultimateWordPress Tab Ultimate plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- favethemes houzez theme - functionalityWordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- favethemes houzez theme - functionalityWordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability7.5 High
- horea radu one page express companionWordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerability4.3 Medium
- wpmu dev - your all-in-one wordpress platform smartcrawlWordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerability5.4 Medium
- bastien ho event postWordPress Event post plugin <= 5.10.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themesion grevoWordPress Grevo theme <= 2.4 - Local File Inclusion vulnerability8.1 High
- stellarwp event ticketsWordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability5.4 Medium
- blockspareWordPress Blockspare plugin <= 3.2.13.2 - Sensitive Data Exposure vulnerability4.3 Medium
- eyecix jobsearchWordPress JobSearch plugin < 3.0.8 - PHP Object Injection vulnerability9.8 Critical
- jonathan jernigan pie calendarWordPress Pie Calendar plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- cristián lávaque s2memberWordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability9.0 Critical
- buddypressWordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability7.5 High
- made neat acknowledgifyWordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerability4.3 Medium
- infomaniak network vod infomaniakWordPress VOD Infomaniak plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerability7.1 High
- wpzoom recipe card blocks for gutenberg & elementorWordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerability6.5 Medium
- josh kohlbach advanced coupons for woocommerce couponsWordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.6.8 - SQL Injection vulnerability7.6 High
- posimyth uichemyWordPress UiChemy plugin <= 4.0.0 - Broken Access Control vulnerability4.3 Medium
- dmitry v. (ceo of "ukr solution") upc/ean/gtin code generatorWordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- acowebs product table for woocommerceWordPress Product Table For WooCommerce plugin <= 1.2.4 - PHP Object Injection vulnerability8.8 High
- bplugins voice feedbackWordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability8.8 High
- veronalabs wp smsWordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability5.4 Medium
- fantasticplugins sumo memberships for woocommerceWordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- weissmike simple finance calculatorWordPress Simple Finance Calculator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- universamWordPress UNIVERSAM plugin <= 9.04.02 - PHP Object Injection vulnerability9.8 Critical
- designthemes single propertyWordPress Single Property theme <= 2.8 - PHP Object Injection vulnerability8.8 High
- quantumcloud kbx pro ultimateWordPress KBx Pro Ultimate plugin <= 8.0.5 - PHP Object Injection vulnerability9.8 Critical
- designthemes knowledge baseWordPress Knowledge Base theme <= 2.9 - PHP Object Injection vulnerability8.8 High
- thimpress wp pipesWordPress WP Pipes plugin <= 1.4.3 - Arbitrary File Deletion vulnerability8.6 High
- axiomthemes white rabbitWordPress White Rabbit theme <= 1.5.2 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes bugspatrolWordPress BugsPatrol theme <= 1.5.0 - PHP Object Injection vulnerability9.8 Critical
- wpshuffle subscribe to downloadWordPress Subscribe to Download plugin <= 2.0.9 - PHP Object Injection vulnerability9.8 Critical
- fantasticplugins sumo memberships for woocommerceWordPress SUMO Memberships for WooCommerce plugin <= 7.8.0 - Privilege Escalation vulnerability8.8 High
- captivateaudio captivate syncWordPress Captivate Sync Plugin <= 3.0.3 - PHP Object Injection Vulnerability9.8 Critical
- pebas couponxxlWordPress CouponXxL theme <= 3.0.0 - Privilege Escalation vulnerability9.8 Critical
- ypromo pt luxa addonsWordPress PT Luxa Addons Plugin <= 1.2.2 - Arbitrary File Deletion Vulnerability7.7 High
- boldthemes addisonWordPress Addison theme < 1.4.8 - PHP Object Injection vulnerability9.8 Critical
- designthemes kriyaWordPress Kriya theme <= 3.4 - PHP Object Injection Vulnerability8.8 High
- boldthemes goldenblattWordPress Goldenblatt theme < 1.3.0 - PHP Object Injection vulnerability9.8 Critical
- whitebox-studio scapeWordPress Scape theme <= 1.5.13 - PHP Object Injection vulnerability9.8 Critical
- designthemes vedaWordPress VEDA Theme <= 4.2 - PHP Object Injection Vulnerability8.8 High
- extendons woocommerce registration fields plugin - custom signup fieldsWordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Privilege Escalation vulnerability8.8 High
- wpeverest everest forms - frontend listing, everest forms frontend listing +1 moreWordPress Everest Forms - Frontend Listing plugin <= 1.0.5 - PHP Object Injection Vulnerability9.8 Critical
- crm perks connector for gravity forms and google sheetsWordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- tusko trush advanced custom fields : cpt options pagesWordPress Advanced Custom Fields : CPT Options Pages plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerability8.8 High
- bearsthemes aloneWordPress Alone theme <= 7.8.3 - Remote Code Execution (RCE) vulnerability10.0 Critical
- tattersoftware wp tesseractWordPress WP Tesseract Plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- integrationshotelrunner hotelrunner booking widgetWordPress HotelRunner Booking Widget Plugin <= 1.6 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- crm perks wp gravity forms hubspotWordPress WP Gravity Forms HubSpot Plugin <= 1.2.5 - Open Redirection Vulnerability4.7 Medium
- nikitas georgopoulos weshare buttonsWordPress WeShare Buttons Plugin <= 13.0.0 - Cross Site Scripting (XSS) Vulnerability5.9 Medium
- Show moreLoading…