CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- metz connect energy-controlling ewio2-m, energy-controlling ewio2-m-bm, ethernet-io ewio2-bm +3 more +5 moreUnauthenticated Local File Inclusion in php module9.8 Critical
- metz connect energy-controlling ewio2-m, energy-controlling ewio2-m-bm, ethernet-io ewio2-bm +3 more +5 morePossible malfunction credential injection9.8 Critical
- iest winplusStored Cross-Site Scripting (XSS) in WinPlus by Informática del Este9.3 Critical
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload <= 1.1.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploads6.4 Medium
- seventhqueen restrictions for buddypressRestrictions for BuddyPress <= 1.5.2 - Missing Authorization to Unauthenticated Tracking Status Update5.3 Medium
- sayontan photonic gallery & lightbox for flickr, smugmug & othersPhotonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Caption Attribute6.4 Medium
- sundayfanz wmodes – catalog mode, product pricing, enquiry forms & promotions | for woocommercewModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure4.3 Medium
- tripleatechnology cryptocurrency payment gateway for woocommerceCryptocurrency Payment Gateway for WooCommerce <= 2.0.25 - Missing Authorization to Unauthenticated Tracking Status Update5.3 Medium
- ninjateam wp duplicate pageWP Duplicate Page <= 1.7 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure4.3 Medium
- bhargavbhandari90 meta display blockMeta Display Block <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- vaniivan simple user import exportSimple User Import Export <= 1.1.7 - Authenticated (Admin+) CSV Injection6.6 Medium
- ideastocode enable svg, webp, and ico uploadEnable SVG, WebP, and ICO Upload <= 1.1.3 - Authenticated (Author+) Arbitrary File Upload via ICO Upload Bypass8.8 High
- f1logic wp twitter auto publishWP Twitter Auto Publish <= 1.7.4 - Reflected Cross-Site Scripting via PostMessage6.1 Medium
- bdthemes element pack – widgets, templates & addons for elementorElement Pack Addons for Elementor <= 8.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Open Street Map widget5.4 Medium
- rajeshsingh520 piweb live sales notification for woocommerceLive sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure7.5 High
- wpwham checkout files upload for woocommerceCheckout Files Upload for WooCommerce <= 2.2.1 - Unauthenticated Stored Cross-Site Scripting7.2 High
- aioseo broken link checker by aioseo – easily fix/monitor internal and external linksBroken Link Checker by AIOSEO – Easily Fix/Monitor Internal and External links <= 1.2.5 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Trashing5.4 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted Open Redirection Vulnerability4.8 Medium
- solarwinds observability self-hostedSolarWinds Observability Self-Hosted XSS Vulnerability5.4 Medium
- solarwinds serv-uSolarWinds Serv-U Path Restriction Bypass Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Broken Access Control - Remote Code Execution Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Logic Abuse - Remote Code Execution Vulnerability9.1 Critical
- everviz – charts, maps and tables – interactive and responsiveeverviz <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- arkadiykilesso download panel (biggiko team)Download Panel <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification4.3 Medium
- awensley project honey pot spam trapProject Honey Pot Spam Trap <= 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- artibot free chat bot for websitesArtiBot Free Chat Bot for WebSites <= 1.1.7 - Reflected Cross-Site Scripting via PostMessage6.1 Medium
- ikhodal category and product woocommerce tabsCategory and Product Woocommerce Tabs <= 1.0 - Authenticated (Contributor+) Local File Inclusion8.8 High
- luigi the permalinks cascadeThe Permalinks Cascade <= 2.2 - Missing Authorization To Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- rometheme rtmkitRTMKit Addons <= 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordion Repeater Block Attribute6.4 Medium
- nazsabuz wp dropzoneWP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload8.8 High
- valentinpellegrin acf flexible layouts managerACF Flexible Layouts Manager <= 1.1.6 - Missing Authorization to Unauthenticated Custom Field Update6.5 Medium
- winkm89 wp admin microblogWP Admin Microblog <= 3.1.1 - Cross-Site Request Forgery to Message Creation4.3 Medium
- codeyatri gutenify – visual site builder blocks & site templates.Gutenify - Visual Site Builder Blocks & Site Templates <= 1.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Count Up block6.4 Medium
- denishua top friendsTop Friends <= 0.3 - Cross-Site Request Forgery to Settings Update4.3 Medium
- willbontrager local syndicationLocal Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode6.4 Medium
- sscovil csv to sorttableCSV to SortTable <= 4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- nikolayyordanov like-itLike-it <= 2.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- interledger coil web monetizationCoil Web Monetization <= 2.0.2 - Cross-Site Request Forgery4.3 Medium
- genetechproducts pie forms — drag & drop form builderPie Forms for WP <= 1.6 - Unauthenticated Arbitrary File Upload8.1 High
- premmerce wholesale pricing for woocommercePremmerce Wholesale Pricing for WooCommerce <= 1.1.10 - Authenticated (Subscriber+) SQL Injection7.1 High
- jemoreto multiple roles per userMultiple Roles per User <= 1.0 - Missing Authorization to Authenticated (Custom+) Privilege Escalation7.2 High
- smci x13sedw-fA stack buffer overflow vulnerability exists in the Supermicro BMC Web function(SSL).7.2 High
- smci mbd-x13sedw-fStack buffer overflow vulnerability exists in the Supermicro BMC Shared library5.5 Medium
- mitsubishi electric corporation milco.s easy setting application (ir), milco.s easy switch application (ir), milco.s setting application +1 more +3 moreMalicious Code Execution Vulnerability in Setting and Operation Application for Lighting Control System MILCO.S7.7 High
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit <= 9.112.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- smci mbd-x13sedw-fA stack buffer overflow vulnerability exists in the Supermicro BMC Web function7.2 High
- smci mbd-x13sedw-fSupermicro BMC SMASH services has a Stack-based buffer overflow vulnerability5.4 Medium
- johnjamesjacoby post type switcherPost Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change5.4 Medium
- gravity forms formsGravity Forms <= 2.9.21.1 - Unauthenticated Arbitrary File Upload via Legacy Chunked Upload8.1 High
- Show moreLoading…