CVEs published in November 2025
3,062 vulnerabilities, 265 critical, 10 exploited.
- themeisle ppom for woocommerceWordPress PPOM for WooCommerce plugin <= 33.0.16 - Broken Access Control vulnerability4.3 Medium
- aman funnel builder by funnelkitWordPress Funnel Builder by FunnelKit plugin <= 3.13.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- envothemes envo extraWordPress Envo Extra plugin <= 1.9.11 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- jegstudio gutenverseWordPress Gutenverse plugin <= 3.2.1 - Broken Access Control vulnerability6.5 Medium
- syed balkhi giveaways and contests by rafflepressWordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- jgwhite33 wp google review sliderWordPress WP Google Review Slider plugin <= 17.4 - Broken Access Control vulnerability5.4 Medium
- frank goossens wp youtube lyteWordPress WP YouTube Lyte plugin <= 1.7.28 - Open Redirection vulnerability3.4 Low
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.13.0 - Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability5.3 Medium
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.13.0 - Sensitive Data Exposure vulnerability5.3 Medium
- boldthemes bold page builderWordPress Bold Page Builder plugin <= 5.5.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- uncanny owl automatorWordPress Uncanny Automator plugin < 6.10.0 - Sensitive Data Exposure vulnerability4.3 Medium
- icegram email subscribers & newslettersWordPress Email Subscribers & Newsletters plugin <= 5.9.10 - PHP Object Injection vulnerability7.2 High
- kriesi enfoldWordPress Enfold theme <= 7.1.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.2.9 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'eh_crm_ticket_single_view_client'4.3 Medium
- techjewel fluentcrm – email newsletter, automation, email marketing, email campaigns, optins, leads, and crm solutionFluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode6.4 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal4.3 Medium
- redhat satellite, the foreman foreman, red hat satellite 6.15 for rhel 8 +6 more +8 moreForeman: satellite: graphql api permission bypass leads to information disclosure5.0 Medium
- linuxACPI: video: Fix use-after-free in acpi_video_switch_brightness()7.3 High
- linuxRevert "NFSD: Remove the cap on number of operations per NFSv4 COMPOUND"7.5 High
- linuxbtrfs: fix memory leak of qgroup_list in btrfs_add_qgroup_relationNo score
- trainingbusinesspros groundhogg — crm, newsletters, and marketing automationGroundhogg <= 4.2.6.1 - Authenticated (Admin+) SQL Injection4.9 Medium
- nmedia simple user registrationSimple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting7.2 High
- nalam-1 magical shop builder – woocommerce template builder for elementor | shop, cart, checkout & product page builderMagical Products Display <= 1.1.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via MPD Pricing Table Widget6.4 Medium
- etruel wp delete post copiesWP Delete Post Copies <= 6.0.2 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- wpdirectorykit wp directory kitWP Directory Kit <= 1.4.3 - Unauthenticated SQL Injection via select_2_ajax() Function7.5 High
- appsbd vitepos – point of sale (pos) for woocommerceVitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution8.8 High
- antiochinteractive shortcode for google street viewShortcode for Google Street View <= 0.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- publishpress schedule post changes with publishpress future: unpublish, delete, change status, trash, change categoriesSchedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories <= 4.9.1 - Authenticated (Author+) Missing Authorization to Post/Page Status Modification4.3 Medium
- devitemsllc ht mega addons for elementor – elementor widgets & template builderHT Mega – Absolute Addons For Elementor <= 3.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Tag Attribute Injection6.4 Medium
- zhengdon 简数采集器简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read4.9 Medium
- bdeleasa wp company infoWP Company Info <= 1.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- devsmip bigbuy dropshipping connector for woocommerceBigBuy Dropshipping Connector for WooCommerce <= 2.0.5 - Unauthenticated IP Spoofing to phpinfo() Exposure5.3 Medium
- wpfanyi wpsite shortcodeWPSite Shortcode <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- nootheme realty portalRealty Portal <= 0.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update8.8 High
- bartboy011 bulma shortcodesBulma Shortcodes <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- surbma | minicrm shortcodeSurbma | MiniCRM Shortcode <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- beycanpress cryptocurrency (token), launchpad (presale), ico & ido, airdrop by tokenicoCryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authorization to Authenticated (Subscriber+) Contract Address Update4.3 Medium
- rustybadrobot display pages shortcodeDisplay Pages Shortcode <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- integrationshotelrunner hotelrunner booking widgetHotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- fastmover shortcodes bootstrapShortcodes Bootstrap <= 1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- beycanpress cryptocurrency (token), launchpad (presale), ico & ido, airdrop by tokenicoCryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Update5.3 Medium
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite <= 3.5.09 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure6.5 Medium
- rustaurius affiliate ai liteAffiliate AI Lite <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpswings return refund and exchange for woocommerceReturn Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read5.4 Medium
- elextensions elex wordpress helpdesk & customer ticketing system, elula wsdesk +1 moreELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Unauthenticated Arbitrary File Upload9.8 Critical
- flothemesplugins flo forms – easy drag & drop form builderFlo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload7.1 High
- powerblogservice authorsureAuthorSure <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting6.1 Medium
- admintwentytwenty uipress lite | effortless custom dashboards, admin themes and pagesUiPress lite | Effortless custom dashboards, admin themes and pages <= 3.5.08 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update4.3 Medium
- Show moreLoading…