CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- axis osThe ACAP Application framework could allow privilege escalation through a symlink attack. This...6.8 Medium
- axis osAn ACAP configuration file lacked sufficient input validation, which could allow a path traversal...6.4 Medium
- axis osAn ACAP configuration file lacked sufficient input validation, which could allow for arbitrary...6.7 Medium
- unknown age-restrictionAge Restriction <= 3.0.2 - Subscriber+ Privilege Escalation7.5 High
- unknown wp go maps (formerly wp google maps)WP Google Maps < 9.0.48 - Unauthenticated Stored XSS8.8 High
- unknown make email customizer for woocommerceMake Email Customizer for WooCommerce <= 1.0.6 - Subscriber+ Arbitrary Options Update5.3 Medium
- paul1999 github gist shortcode pluginGitHub Gist Shortcode Plugin <= 0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- eggemplo live photos on wordpressLive Photos on WordPress <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- mer.vin featured imageFeatured Image <= 2.1 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- krishaweb multi location markerAdd Multiple Marker <= 1.2 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- astrasecuritysuite astra security suite – firewall & malware scanAstra Security Suite – Firewall & Malware Scan <= 0.2 - Unauthenticated Arbitrary File Upload8.1 High
- andrico coon google mapsCoon Google Maps <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- odude crypto toolCrypto Tool <= 2.22 - Unauthenticated Information Exposure via Global Authentication State5.3 Medium
- mheob include fussball.de widgetsInclude fussball.de Widgets <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'api' and 'type'6.4 Medium
- koopersmith elastic theme editorElastic Theme Editor <= 0.0.3 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- ryanmoyer the total book projectThe Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation5.4 Medium
- jahed jeba cute forkitJeba Cute forkit <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- ethoseo simple donateSimple Donate <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- caselock twitter feedTwitter Feed <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sitedin wp count down timerWP Count Down Timer <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- mmdeveloper preload current imagesPreload Current Images <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- elvismdev woocommerce – products by custom taxWoocommerce – Products By Custom Tax <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- spokanetony squirrels auto inventorySquirrels Auto Inventory <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- coenjacobs paypal donation shortcodePaypal Donation Shortcode <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- softivus wislyWisly <= 1.0.0 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation5.3 Medium
- mrx3k1 wp-iconicsWP-Iconics <= 0.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- lovelightplugins ninja countdown | fastest countdown builderNinja Countdown <= 1.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Countdown Deletion4.3 Medium
- michielve private google calendarsPrivate Google Calendars <= 20250811 - Missing Authorization to Authenticated (Subscriber+) Settings Reset4.3 Medium
- simonpedge precise columnsPrecise Columns <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- sagortouch chart expertChart Expert <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- pubudu-malalasekara post blocks & toolsMagazine Companion <= 1.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- kddiwebcommunications wp移行専用プラグイン for cpiWP移行専用プラグイン for CPI <= 1.0.2 - Unauthenticated Arbitrary File Upload9.8 Critical
- strix-bubol5 holiday class post calendarHoliday class post calendar <= 7.1 - Unauthenticated Remote Code Execution via 'contents'9.8 Critical
- pritenhshah share to google classroomShare to Google Classroom <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via share_to_google Shortcode6.4 Medium
- easycommerce – ai-powered wordpress ecommerce plugin to sell digital products, subscriptions & physical goodsEasyCommerce – AI-Powered, Blazing-Fast & Beautiful WordPress Ecommerce Plugin 0.9.0-beta2 - 1.8.2 - Unauthenticated Privilege Escalation9.8 Critical
- andreaferracani ysliderYSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- eventbee ticketing widgetEventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- behzadrohizadeh usb qr code scanner for woocommerceUSB Qr Code Scanner For Woocommerce <= 1.0.0 - Cross-Site Request Forgery to Settings Update4.3 Medium
- hectavex wp-oauthWP-OAuth <= 0.4.1 - Reflected Cross-Site Scripting6.1 Medium
- kanwei doublethedonation double the donation – a workplace giving toolDouble the Donation <= 3.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting4.9 Medium
- nuvuscripts flickr showFlickr Show <= 1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- baronen wp-wallaWP-Walla <= 0.5.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- larsactionhero wp custom admin login page logoWP Custom Admin Login Page Logo <= 1.4.8.4 - Cross-Site Request Forgery to Settings Update4.3 Medium
- ngothoai document pro elementor – documentation & knowledge baseDocument Pro Elementor – Documentation & Knowledge Base <= 1.0.9 - Unauthenticated Information Exposure5.3 Medium
- miunosoft auto amazon links – amazon associates affiliate pluginAuto Amazon Links – Amazon Associates Affiliate Plugin <= 5.4.3 - Unauthenticated Arbitrary File Read7.5 High
- rampantlogic geopostGeopost <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpkube authors listAuthors List <= 2.0.6.1 - Authenticated (Contributor+) Sensitive Information Exposure via Limited Method Call in Plugin's Shortcode6.5 Medium
- doytch skip to timestampSkip to Timestamp <= 1.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- wpcox nonaki – drag and drop email template builder and newsletter plugin for wordpressNonaki – Drag and Drop Email Template builder and Newsletter plugin for WordPress <= 1.0.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields6.4 Medium
- codethislab ctl arcade liteCTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation4.3 Medium
- Show moreLoading…