CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- wasiliy strecker / contestgallery developer contest galleryWordPress Contest Gallery plugin <= 28.0.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- anibalwainstein effect makerWordPress Effect Maker plugin <= 1.2.1 - Broken Access Control vulnerability6.5 Medium
- ido kobelkowsky simple paymentWordPress Simple Payment plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability7.1 High
- ido kobelkowsky simple paymentWordPress Simple Payment plugin <= 2.4.6 - Local File Inclusion vulnerability7.5 High
- amauri wpmobile.appWordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerability7.1 High
- elated-themes savoryWordPress Savory theme <= 2.5 - Local File Inclusion vulnerability8.1 High
- fuelthemes revolutionWordPress Revolution theme < 2.5.8 - Local File Inclusion vulnerability7.5 High
- rometheme rtmkitWordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability9.9 Critical
- elated-themes search & goWordPress Search & Go theme <= 2.7 - Broken Authentication vulnerability9.8 Critical
- brainstorm force surerankWordPress SureRank plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability7.1 High
- favethemes houzez theme - functionalityWordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability7.1 High
- elated-themes academistWordPress Academist theme < 1.3 - Local File Inclusion vulnerability8.1 High
- favethemes houzezWordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability8.1 High
- andondesign udesign coreWordPress UDesign Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- stylemix cost calculator builderWordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability6.5 Medium
- case-themes case addonsWordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerability9.9 Critical
- codexthemes thegem demo import (for wpbakery)WordPress TheGem Demo Import (for WPBakery) plugin <= 5.10.5 - Arbitrary Content Deletion vulnerability6.5 Medium
- codexthemes thegem theme elements (for wpbakery)WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability8.1 High
- codexthemes thegem theme elements (for wpbakery)WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codexthemes thegem (elementor)WordPress TheGem (Elementor) theme <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- yop pollWordPress YOP Poll plugin <= 6.5.37 - Cross Site Scripting (XSS) vulnerability7.1 High
- ays pro ai chatbot with chatgpt and content generator by aysWordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability7.5 High
- hamastar technology meetinghubWordPress MeetingHub plugin <= 1.23.9 - Sensitive Data Exposure vulnerability6.5 Medium
- uxper togoWordPress Togo theme < 1.0.4 - Broken Access Control vulnerability6.5 Medium
- uxper togoWordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerability7.1 High
- uxper togoWordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability8.8 High
- uxper togoWordPress Togo theme < 1.0.4 - Privilege Escalation vulnerability8.8 High
- uxper togoWordPress Togo theme < 1.0.4 - Broken Access Control vulnerability6.5 Medium
- tagdiv cloud libraryWordPress tagDiv Cloud Library plugin < 3.9.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- tagdiv composerWordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability7.1 High
- tagdiv composerWordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themenectar salientWordPress Salient theme < 17.4.0 - Broken Access Control vulnerability4.3 Medium
- hogash kallyasWordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability5.3 Medium
- hogash kallyasWordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability5.4 Medium
- hogash kallyasWordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerability9.9 Critical
- apustheme itokWordPress ITok theme <= 1.1.42 - Local File Inclusion vulnerability8.1 High
- codexthemes thegem (elementor)WordPress TheGem (Elementor) theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- codexthemes thegemWordPress TheGem theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- apustheme famitaWordPress Famita theme <= 1.54 - Local File Inclusion vulnerability8.1 High
- wpclever wpc product options for woocommerceWordPress WPC Product Options for WooCommerce plugin <= 3.1.3 - Local File Inclusion vulnerability7.5 High
- bux woocommerceWordPress Bux Woocommerce plugin <= 1.2.3 - Broken Access Control vulnerability6.5 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.12 - PHP Object Injection vulnerability9.8 Critical
- realmag777 tableonWordPress TableOn plugin <= 1.0.5.1 - Content Injection vulnerability7.1 High
- holest engineering selling commander for woocommerceWordPress Selling Commander for WooCommerce plugin <= 1.2.46 - Privilege Escalation vulnerability9.8 Critical
- anatoly download counterWordPress Download Counter plugin <= 1.4 - Arbitrary File Download vulnerability7.5 High
- premmerceWordPress Premmerce plugin <= 1.3.19 - Local File Inclusion vulnerability7.5 High
- alexander anycommentWordPress AnyComment plugin <= 0.3.6 - Local File Inclusion vulnerability7.5 High
- codexpert, inc coschool lmsWordPress CoSchool LMS plugin <= 1.4.3 - SQL Injection vulnerability8.5 High
- plugify support ticket system for woocommerce (premium)WordPress Support Ticket System for WooCommerce plugin <= 2.0.7 - Arbitrary File Upload vulnerability10.0 Critical
- addify custom user registration fields for woocommerceWordPress Custom User Registration Fields for WooCommerce plugin <= 2.1.2 - Arbitrary File Upload Vulnerability10.0 Critical
- Show moreLoading…