Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 5,493 published records · 23 KEV · 5,493 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

5,493 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit3175.8%
High1,53028%
Med2,03937%
Low1262.3%
None10.02%
Legacy00.00%
Unscored1,48027%

Matching records by UTC month

Dec 255,493

Signal coverage

KEV-listed: 23
With a forecast: 5,493
Unknown date: 0
Unscored severity: 1,480

Share of cohort: KEV 0.42% · forecast 100% · unscored 27%.

Showing 1701–1720 of 5,493By severity band: Critical · 9.0–10.0 317, High · 7.0–8.9 1,530, Medium · 4.0–6.9 2,039, Low · 0.1–3.9 126, None · scored 0.0 1, Legacy · v2 only 0, Unscored · no CNA metric 1,480

HighPublished 21 Dec 2025, 09:20 WIB

CVE-2025-12980

Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the '/ultp/v2/get_dynamic_content/' REST API endpoint in all versions up to, and including, 5.0.3. This makes it possible for unauthenticated a…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T02:20:32.805Z. Updated 2026-04-08T17:30:34.314Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:30 WIB

Official record

MedPublished 21 Dec 2025, 09:20 WIB

CVE-2025-14043

Tainacan <= 1.0.1 - Missing Authorization to Unauthenticated Arbitrary Metadata Section Creation

The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and including, 1.0.1. This is due to the `create_item_permissions_check()` function unconditionally returning true, which bypasses authentication and authorization validat…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Showing 1701 to 1720 of 5493.First page Next page

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T02:20:32.422Z. Updated 2026-04-08T16:53:31.704Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:53 WIB

Official record

MedPublished 21 Dec 2025, 09:20 WIB

CVE-2025-14054

WC Builder <= 1.2.0 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'heading_color' Shortcode Attribute

The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and multiple other styling parameters) of the `wpbforwpbakery_product_additional_information` shortcode in all versions up to, and including, 1.2.0 due to insuffici…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T02:20:32.034Z. Updated 2026-04-08T16:51:43.741Z.

CVSS4.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:51 WIB

Official record

MedPublished 21 Dec 2025, 09:20 WIB

CVE-2025-13838

WishSuite <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button_text' Shortcode Attribute

The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T02:20:31.615Z. Updated 2026-04-08T16:51:40.521Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:51 WIB

Official record

HighPublished 21 Dec 2025, 09:20 WIB

CVE-2025-14071

Live Composer – Free WordPress Website Builder <= 2.0.2 - Authenticated (Contributor+) PHP Object Injection via dslc_module_posts_output Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via deserialization of untrusted input in the dslc_module_posts_output shortcode. This makes it possible for authenticated attackers, with Contributor-level access an…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T02:20:31.199Z. Updated 2026-04-08T16:50:55.587Z.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:50 WIB

Official record

MedPublished 21 Dec 2025, 09:20 WIB

CVE-2025-14080

Frontend Post Submission Manager Lite <= 1.2.5 - Missing Authorization to Unauthenticated Arbitrary Post Modification

The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due to missing authorization checks on the post update functionality in the fpsml_form_process AJAX action. This makes it possible for unauthenticated attackers to m…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T02:20:30.792Z. Updated 2026-04-08T16:47:57.152Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:47 WIB

Official record

MedPublished 21 Dec 2025, 09:20 WIB

CVE-2025-11496

Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site Scripting

The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T02:20:30.185Z. Updated 2026-04-08T16:37:37.858Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:37 WIB

Official record

MedPublished 21 Dec 2025, 07:06 WIB

CVE-2023-47232

WordPress WP Affiliate Disclosure plugin <= 1.2.6 - Broken Access Control + CSRF vulnerability

Vulnerability in mojofywp WP Affiliate Disclosure wp-affiliate-disclosure.This issue affects WP Affiliate Disclosure: from n/a through 1.2.6.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T00:06:36.830Z. Updated 2026-04-28T16:08:48.999Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:08 WIB

Official record

HighPublished 21 Dec 2025, 07:01 WIB

CVE-2023-25446

WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in HappyFiles HappyFiles Pro happyfiles-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HappyFiles Pro: from n/a through 1.8.1.

Excerpt language: en.

Severity high: primary CNA CVSS 7.7 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T00:01:58.948Z. Updated 2026-04-28T16:08:07.906Z.

CVSS7.7v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:08 WIB

Official record

MedPublished 21 Dec 2025, 07:00 WIB

CVE-2023-25445

WordPress HappyFiles Pro plugin <= 1.8.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in HappyFiles HappyFiles Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HappyFiles Pro: from n/a through 1.8.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-21T00:00:41.013Z. Updated 2026-04-28T16:08:07.875Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:08 WIB

Official record

MedPublished 21 Dec 2025, 06:58 WIB

CVE-2023-25068

WordPress Magazine Edge theme <= 1.13 - Authenticated Arbitrary Plugin Activation

Missing Authorization vulnerability in Mapro Collins Magazine Edge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Magazine Edge: from n/a through 1.13.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T23:58:16.726Z. Updated 2026-04-28T16:08:07.856Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:08 WIB

Official record

MedPublished 21 Dec 2025, 06:32 WIB

CVE-2025-14989

Campcodes Complete Online Beauty Parlor Management System search-invoices.php sql injection

A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/search-invoices.php. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.9 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T23:32:06.196Z. Updated 2026-02-24T05:59:10.097Z.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated24 Feb 2026, 12:59 WIB

Official record

HighPublished 21 Dec 2025, 03:01 WIB

CVE-2025-34290

Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation

Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating the requesting user. D…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 8.5 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T20:01:42.552Z. Updated 2025-12-22T16:17:23.123Z.

CVSS8.5v4.0KEVNot listedEPSSPresentUpdated22 Dec 2025, 23:17 WIB

Official record

HighPublished 20 Dec 2025, 20:47 WIB

CVE-2025-7782

WP JobHunt <= 7.7 - Missing Authorization to Authenticated (Candidate+) Stored Cross-Site Scripting via 'status'

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the 'cs_update_application_status_callback' function in all versions up to, and including, 7.7. This makes it possible for authenticated attackers, with Candidate-lev…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T13:47:43.316Z. Updated 2026-04-08T17:15:28.433Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:15 WIB

Official record

MedPublished 20 Dec 2025, 20:47 WIB

CVE-2025-7733

WP JobHunt <= 7.7 - Authenticated (Candidate+) Insecure Direct Object Reference

The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 via the 'cs_update_application_status_callback' due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Candi…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T13:47:42.695Z. Updated 2026-04-08T16:48:27.090Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:48 WIB

Official record

MedPublished 20 Dec 2025, 15:22 WIB

CVE-2025-14298

FiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for aut…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T08:22:10.732Z. Updated 2026-04-08T17:03:42.489Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:03 WIB

Official record

MedPublished 20 Dec 2025, 15:22 WIB

CVE-2025-12492

Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin <= 2.11.0 - Unauthenticated Sensitive Information Exposure

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.11.0 via the ajax_get_members function. This is due to the use of a predictable low-entropy toke…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T08:22:10.037Z. Updated 2026-04-08T16:56:46.075Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated08 Apr 2026, 23:56 WIB

Official record

CritPublished 20 Dec 2025, 13:22 WIB

CVE-2025-13619

Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation

The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated at…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity critical: primary CNA CVSS 9.8 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T06:22:02.869Z. Updated 2026-04-08T17:12:47.007Z.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:12 WIB

Official record

UnscoredPublished 20 Dec 2025, 13:00 WIB

CVE-2025-12820

Pure WC Variation Swatches <= 1.1.7 - Unauthenticated Settings Update

The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authenticated users to update them.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T06:00:08.473Z. Updated 2026-04-02T12:39:53.175Z.

CVSS—KEVNot listedEPSSPresentUpdated02 Apr 2026, 19:39 WIB

Official record

MedPublished 20 Dec 2025, 10:20 WIB

CVE-2025-13365

WP Hallo Welt <= 1.4. - Cross-Site Request Forgery to Stored Cross-Site Scripting

The WP Hallo Welt plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the 'hallo_welt_seite' function. This makes it possible for unauthenticated attackers to update plugin settings and inject malicious web s…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 6.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-12-20T03:20:25.202Z. Updated 2026-04-08T17:29:31.845Z.

CVSS6.1v3.1KEVNot listedEPSSPresentUpdated09 Apr 2026, 00:29 WIB

Official record