CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall cancelUserOrder improper authorization5.3 Medium
- macrozheng mall, mall-swarm +1 moremacrozheng mall-swarm/mall Order Details detail improper authorization5.3 Medium
- macrozheng mall-swarmmacrozheng mall-swarm attr updateAttr improper authorization5.3 Medium
- t-innova deporsite dsuite 2025Insecure Direct Object References (IDOR) in DeporSite of T-Innova DeporSite5.3 Medium
libpqAlmaLinux,postgresqlAlmaLinux,libpq-debuginfoRed Hat +83 more +85 morePostgreSQL libpq undersizes allocations, via integer wraparound5.9 MediumpostgresqlAlmaLinux,libpqopenEuler,pgauditAlmaLinux +78 more +80 morePostgreSQL CREATE STATISTICS does not check for schema CREATE privilege3.1 Low- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.7.5 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.7.5 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreCommand injection vulnerability allowing arbitrary command execution on Windows6.8 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 moreRemote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)9.1 Critical
- xcally omnichannelCross-Site Scripting (XSS) in xCally Omnichannel5.1 Medium
- smub envira gallery – image photo gallery, albums, video gallery, slideshows & moreGallery Plugin for WordPress – Envira Photo Gallery <= 1.12.0 - Missing Authorization to Authenticated (Author+) Multiple Gallery Actions4.3 Medium
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.5.3 - Broken Access Control vulnerability5.3 Medium
- qode qi blocksWordPress Qi Blocks plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- webtoffee order export & order import for woocommerceWordPress Order Export & Order Import for WooCommerce plugin <= 2.6.7 - Broken Access Control vulnerability4.3 Medium
- wpdevelop booking calendarWordPress Booking Calendar plugin <= 10.14.7 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- booster for woocommerce, pluggabl booster for woocommerce +1 moreWordPress Booster for WooCommerce plugin <= 7.3.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- booster for woocommerce, pluggabl booster for woocommerce +1 moreWordPress Booster for WooCommerce plugin <= 7.4.0 - Broken Access Control vulnerability4.3 Medium
- yop pollWordPress YOP Poll plugin <= 6.5.38 - Broken Access Control vulnerability5.3 Medium
- codepeople contact form emailWordPress Contact Form Email plugin <= 1.3.58 - Broken Access Control vulnerability6.5 Medium
- pascalbajorat analytics germanized for google analyticsWordPress Analytics Germanized for Google Analytics plugin <= 1.6.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- quantumcloud chatbotWordPress ChatBot plugin <= 7.3.9 - Broken Access Control vulnerability5.3 Medium
- ays pro survey makerWordPress Survey Maker plugin <= 5.1.9.4 - Broken Access Control vulnerability6.5 Medium
- wpdevelop booking managerWordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- wpkoithemes wpkoi templates for elementorWordPress WPKoi Templates for Elementor plugin <= 3.4.4 - Broken Access Control vulnerability4.3 Medium
- hasthemes wp plugin managerWordPress WP Plugin Manager plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- edgarrojas woocommerce pdf invoice builderWordPress WooCommerce PDF Invoice Builder plugin <= 1.2.150 - Broken Access Control vulnerability4.3 Medium
- wpswings woocommerce ultimate points and rewardsWordPress WooCommerce Ultimate Points And Rewards plugin <= 2.10.2 - Sensitive Data Exposure vulnerability4.3 Medium
- n-media frontend file managerWordPress Frontend File Manager plugin <= 23.2 - Broken Access Control vulnerability4.3 Medium
- aman popup addon for ninja formsWordPress Popup addon for Ninja Forms plugin <= 3.5.1 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- pluginever wp content pilotWordPress WP Content Pilot plugin <= 2.1.7 - Broken Access Control vulnerability5.4 Medium
- ramon fincken auto prune postsWordPress Auto Prune Posts plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- codepeople appointment booking calendarWordPress Appointment Booking Calendar plugin <= 1.3.95 - Broken Access Control vulnerability5.4 Medium
- jeroen schmit theater for wordpressWordPress Theater for WordPress plugin <= 0.18.8 - Broken Access Control vulnerability5.3 Medium
- smci sys-111c-nrSupermicro BMC SMASH services has a Stack-based buffer overflow vulnerability5.4 Medium
- aumsrini wordpress content flipperWordPress Content Flipper <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- benmoody wp headless cms frameworkWP Headless CMS Framework <= 1.15 - Unauthenticated Protection Mechanism Bypass5.3 Medium
- kayapati angel – fashion model agency wordpress cms themeAngel – Fashion Model Agency WordPress CMS Theme <= 3.2.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- restpack save as pdf buttonSave as PDF Button <= 1.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via restpackpdfbutton Shortcode6.4 Medium
- sanderkah convert webp & avif | quicq | best image optimizer and compression plugin | improve your google pagespeedConvert WebP & AVIF | Quicq | Best image optimizer and compression plugin | Improve your Google Pagespeed <= 2.0.0 - Missing Authorization to Authenticated (Subscriber+) Afosto Disconnect4.3 Medium
redisTuxCare,redis-develTuxCare,redis-docTuxCare +2 moreUpdate of redisNo score- tigroumeow ai engine – the chatbot, ai framework & mcp for wordpressAI Engine <= 3.1.8 - Authenticated (Subscriber+) PHP Object Injection via PHAR Deserialization7.1 High
- ronalfy comment edit core – simple comment editingComment Edit Core – Simple Comment Editing <= 3.1.0 - Unauthenticated Sensitive Information Exposure5.3 Medium
- ays-pro poll maker – versus polls, anonymous polls, image pollsPoll Maker – Versus Polls, Anonymous Polls, Image Polls <= 6.0.7 - Authenticated (Administrator+) SQL Injection via `filterbyauthor` Parameter4.9 Medium
- ays pro survey makerSurvey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Information Exposure5.3 Medium
- brainstormforce sureforms – contact form, payment form & other custom form builderSureForms <= 1.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure5.3 Medium
- chrisbadgett lifterlms – wp lms for elearning, online courses, & quizzesLifterLMS – WP LMS for eLearning, Online Courses, & Quizzes - Various Versions - Authenticated (Student+) Privilege Escalation8.8 High
- ays pro survey makerSurvey Maker <= 5.1.9.4 - Missing Authorization to Unauthenticated Limited Option Update5.3 Medium
- wpallimport wp all import – drag & drop import for csv, xml, excel & google sheetsImport any XML, CSV or Excel File to WordPress (WP All Import) <= 3.9.6 - Authenticated (Administrator+) Remote Code Execution via Conditional Logic8.8 High
- nanbu welcart e-commerceWelcart e-Commerce <= 2.11.24 - Missing Authorization to Unauthenticated Information Exposure5.3 Medium
- Show moreLoading…