CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- kevingillispie schema scalpelSchema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema6.4 Medium
- jackdewey community eventsCommunity Events <= 1.5.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- fernandobt list category postsList category posts <= 0.92.0 - Authenticated (Contributor+) Information Exposure4.3 Medium
- softaculous siteseo – seo simplifiedSiteSEO – SEO Simplified <= 1.3.1 - Missing Authorization to Authenticated (Author+) Plugin Settings Update4.3 Medium
- wipeoutmedia css & javascript toolboxCSS & JavaScript Toolbox <= 12.0.5 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile appPost SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure9.8 Critical
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal and DXP do not check permissions of images in a blog entry6.9 Medium
- j 3rk inactive logoutInactive Logout <= 3.5.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- whyun wpcom memberWPCOM Member <= 1.7.14 - Authenticated (Contributor+) Local File Inclusion via Shortcode8.8 High
- wplegalpages privacy policy generator – wplp legal pagesPrivacy Policy Generator, Terms & Conditions Generator WordPress Plugin : WP Legal Pages <= 3.5.1 - Missing Authorization to Unauthenticated API Disconnect5.3 Medium
- barn2 plugins document library liteDocument Library Lite <= 1.1.6 - Missing Authorization to Sensitive Information Exposure5.3 Medium
- google androidIn bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due...8.0 High