CVEs published in October 2025
4,220 vulnerabilities, 323 critical, 10 exploited.
- mark o'donnell mstw csv exporterWordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability5.3 Medium
- matt mcinvale next page, not next postWordPress Next Page, Not Next Post plugin <= 0.3.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tempranova wp mapbox gl js mapsWordPress WP Mapbox GL JS Maps plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- dfactory events maker by dfactoryWordPress Events Maker by dFactory plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- nick diego blox liteWordPress Blox Lite plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- joe open currency converterWordPress Open Currency Converter plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- reoon technology email verifierWordPress Reoon Email Verifier plugin <= 2.0.1 - Broken Access Control vulnerability4.3 Medium
- johnny post list featured imageWordPress Post List Featured Image plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jthemes xsmartWordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability4.3 Medium
- ilmosys open close woocommerce storeWordPress Open Close WooCommerce Store plugin <= 5.0.0 - Broken Access Control vulnerability4.3 Medium
- mejar wp business hoursWordPress WP Business Hours plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- prakash awesome testimonialsWordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- wprio table block by riovizualWordPress Table Block by RioVizual plugin <= 3.0.0 - Broken Access Control vulnerability4.3 Medium
- microsoftstart msn partner hubWordPress MSN Partner Hub plugin <= 2.9 - Broken Access Control vulnerability4.3 Medium
- romancode mapsvgWordPress MapSVG plugin <= 8.7.22 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- pickplugins testimonial sliderWordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability6.5 Medium
- joby joseph seo meta description updaterWordPress SEO Meta Description Updater plugin <= 1.2.0 - Broken Access Control vulnerability4.3 Medium
- nelio software contentWordPress Nelio Content plugin <= 4.0.5 - Broken Access Control vulnerability6.5 Medium
- conversios conversios.ioWordPress Conversios.io plugin <= 7.2.13 - Broken Access Control vulnerability5.4 Medium
- pickplugins post grid and gutenberg blocksWordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability6.5 Medium
- debuggers studio marquee addons for elementorWordPress Marquee Addons for Elementor plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- shambhu patnaik export categoriesWordPress Export Categories plugin <= 1.0 - Broken Access Control vulnerability5.3 Medium
- pagup bulk auto image title attributeWordPress Bulk Auto Image Title Attribute plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webnique usercentrics cmpWordPress USERCENTRICS CMP plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- themeshopy ts demo importerWordPress TS Demo Importer plugin <= 0.1.3 - Broken Access Control vulnerability5.4 Medium
- ignitionwp ignitiondeckWordPress IgnitionDeck plugin <= 2.0.15 - Broken Access Control vulnerability5.4 Medium
- jamel.z tooltipyWordPress Tooltipy plugin <= 5.5.9 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- travon wp flights & hotels booking wp pluginWordPress Flights & Hotels Booking WP Plugin plugin <= 3.1 - Broken Access Control vulnerability5.4 Medium
- clicksend sms contact form 7 notifications by clicksendWordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerability4.3 Medium
- wpopal opal serviceWordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- siteground email marketingWordPress SiteGround Email Marketing plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- rock content convertWordPress Rock Convert plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- deshine video gallery by huzzazWordPress Video Gallery by Huzzaz plugin <= 10.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- mrityunjay smart wetransferWordPress Smart WeTransfer plugin <= 1.3 - Broken Access Control vulnerability4.3 Medium
- aviplugins.com custom post type attachmentWordPress Custom Post Type Attachment plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- epiphanyit321 referral link trackerWordPress Referral Link Tracker plugin <= 1.1.4 - Broken Access Control vulnerability4.3 Medium
- justin tadlock query postsWordPress Query Posts plugin <= 0.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- ben huson wp geoWordPress WP Geo plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpclever wpc smart messages for woocommerceWordPress WPC Smart Messages for WooCommerce plugin <= 4.2.8 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themehunk wp popup builderWordPress WP Popup Builder plugin <= 1.3.8 - Sensitive Data Exposure vulnerability5.3 Medium
- weblineindia popular posts by weblineWordPress Popular Posts by Webline plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- thrive - web design gold coast photospace responsiveWordPress Photospace Responsive plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- maarten links shortcodeWordPress Links shortcode plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- brecht wp recipe makerWordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerability5.3 Medium
- digitaldonkey multilang contact formWordPress Multilang Contact Form plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- vito peleg atarimWordPress Atarim plugin <= 4.2.1 - Sensitive Data Exposure vulnerability5.3 Medium
- magicoders acf recent posts widgetWordPress ACF Recent Posts Widget plugin <= 5.9.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.5.3 - Broken Access Control vulnerability5.3 Medium
- jory hogeveen off-canvas sidebars & menus (slidebars)WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- premmerce brands for woocommerceWordPress Premmerce Brands for WooCommerce plugin <= 1.2.13 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- Show moreLoading…