CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- shahjahan jewel wp gdpr cookie consentWordPress WP GDPR Cookie Consent plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability7.1 High
- jhainey milevis dropifyWordPress Dropify plugin <= 4.7.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- borisolhor drop uploader for cf7 - drag&drop file uploader addonWordPress Drop Uploader for CF7 - Drag&Drop File Uploader Addon Plugin <= 2.4.1 - Arbitrary File Upload Vulnerability10.0 Critical
- zozothemes zegenWordPress Zegen Theme <= 1.1.9 - Local File Inclusion Vulnerability7.5 High
- gaurav aggarwal backup and moveWordPress Backup and Move Plugin <= 0.1 - Broken Access Control Vulnerability6.5 Medium
- afzal multani wp logo changerWordPress WP Logo Changer Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability7.1 High
- victorthemes seilWordPress Seil Theme <= 1.7.1 - Deserialization of untrusted data Vulnerability9.8 Critical
- bnovotny user registration aideWordPress User Registration Aide Plugin <= 1.5.3.8 - Cross Site Scripting (XSS) Vulnerability7.1 High
- sertifier certificate & badge makerWordPress Sertifier Certificate & Badge Maker plugin <= 1.21 - Broken Access Control Vulnerability6.5 Medium
- hiecor payment gateway pluginWordPress HieCOR Payment Gateway plugin plugin <= 1.5.11 - SQL Injection vulnerability9.3 Critical
- marielav flexosliderWordPress flexoslider plugin <= 1.0004 - Cross Site Scripting (XSS) vulnerability7.1 High
- pencidesign penci bookmark & followWordPress Penci Bookmark & Follow plugin < 2.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- pluginscafe range slider addon for gravity formsWordPress Range Slider Addon for Gravity Forms plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.5.3 - Cross Site Scripting (XSS) vulnerability7.1 High
- bplugins advanced scrollbarWordPress Advanced scrollbar plugin <= 1.1.8 - Privilege Escalation vulnerability8.8 High
- easy appointments appointments, easyappointments easy appointments +1 moreWordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability6.5 Medium
- bplugins image gallery block – create and display photo gallery/photo album.WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 1.0.7 - Broken Authentication vulnerability7.1 High
- fetch designs sign-up sheetsWordPress Sign-up Sheets Plugin <= 2.3.2 - PHP Object Injection Vulnerability9.8 Critical
- christophrado cookie notice & consentWordPress Cookie Notice & Consent plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- scott reilly preserve code formattingWordPress Preserve Code Formatting Plugin <= 4.0.1 - PHP Object Injection Vulnerability8.8 High
- villatheme happyWordPress HAPPY plugin <= 1.0.7 - Remote Code Execution (RCE) vulnerability10.0 Critical
- daman jeet real time validation for gravity formsWordPress Real Time Validation for Gravity Forms <= 1.7.0 - Local File Inclusion Vulnerability7.5 High
- bslthemes kinsleyWordPress Kinsley theme <= 3.4.4 - Local File Inclusion vulnerability8.1 High
- cocobasic blanka - one page wordpress themeWordPress Blanka - One Page WordPress Theme Theme < 1.5 - Local File Inclusion Vulnerability8.1 High
- rainbow-themes education wordpress theme | histudyWordPress Education WordPress Theme | HiStudy theme < 3.1.0 - SQL Injection vulnerability9.3 Critical
- wpdreams ajax search liteWordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability5.5 Medium
- zipang simple stripeWordPress Simple Stripe plugin <= 0.9.17 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- andriassundskard wpnamedusersWordPress wpNamedUsers plugin <= 0.5 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- norbert slick google mapWordPress Slick Google Map plugin <= 0.3 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- nitinmaurya12 block countryWordPress Block Country plugin <= 1.0 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability7.1 High
- acowebs dynamic pricing with discount rules for woocommerceWordPress Dynamic Pricing With Discount Rules for WooCommerce plugin <= 4.5.9 - Arbitrary Code Execution vulnerability9.1 Critical
- pantherius modal surveyWordPress Modal Survey plugin <= 2.0.2.0.1 - Local File Inclusion vulnerability8.1 High
- mikado-themes wanderlandWordPress Wanderland theme <= 1.7.1 - Local File Inclusion Vulnerability8.1 High
- mikado-themes dør, qodeinteractive dor +1 moreWordPress Dør theme <= 2.4 - Local File Inclusion Vulnerability8.1 High
- flippercode advanced google mapsWordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerability4.3 Medium
- select-themes dessauWordPress Dessau theme < 1.9 - Local File Inclusion vulnerability7.5 High
- widgetlogic.org widget logicWordPress Widget Logic <= 6.0.5 - Remote Code Execution (RCE) Vulnerability9.9 Critical
- bingu replymailWordPress replyMail plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability7.1 High
- axiomthemes smart seo, smartseo +1 moreWordPress smart SEO plugin <= 4.0 - SQL Injection Vulnerability8.5 High
- wpmu dev - your all-in-one wordpress platform smush image compression and optimizationWordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability4.1 Medium
- apollographql routerApollo Router Core: Access Control Bypass on Polymorphic Types7.5 High
- apollographql routerApollo Router Improperly Enforces Renamed Access Control Directives7.5 High
- etaminstudio prosemirror to htmlProsemirrorToHtml: Cross-Site Scripting vulnerability through unescaped HTML attribute values7.6 High
github.com/opentofu/opentofuGoOpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses3.1 Low- idis icm viewerIDIS ICM Viewer Argument Injection8.7 High
- simonw datasetteOpen redirect endpoint in Datasette2.7 Low
- containerdcontainerd affected by a local privilege escalation via wide permissions on CRI directory7.3 High
- proliz software ltd. co. obs (student affairs information system)XSS in Proliz's OBS8.9 High
- netcad software inc. netigmaHTML Injection in Netcad Software's Netigma6.1 Medium
- elastic kibanaImproper preservation of permissions in Elastic Defend on Windows hosts can lead to arbitrary...7.0 High
- Show moreLoading…