Explore CVE records

CritPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23953

WordPress user files plugin <= 2.4.2 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Scriptonite user files user-files allows Upload a Web Shell to a Web Server.This issue affects user files: from n/a through <= 2.4.2.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:03 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23949

WordPress Improved Sale Badges – Free Version Plugin <= 1.0.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dzeriho Improved Sale Badges – Free Version improved-sale-badges-free-version allows PHP Local File Inclusion.This issue affects Improved Sale Badges – Free Version: from n/a through <= 1.0.1.

Excerpt language: en.

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23948

WordPress Background animation blocks Plugin <= 2.1.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Webarea Background animation blocks background-animation-blocks allows PHP Local File Inclusion.This issue affects Background animation blocks: from n/a through <= 2.1.5.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:06 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23944

WordPress WOOEXIM Plugin <= 5.0.0 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:03 WIB

Official record

CritPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23942

WordPress WP Load Gallery Plugin <= 2.1.6 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server.This issue affects WP Load Gallery: from n/a through <= 2.1.6.

Excerpt language: en.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:07 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23938

WordPress Image Gallery Box by CRUDLab Plugin <= 1.0.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CRUDLab Image Gallery Box by CRUDLab image-gallery-box-by-crudlab allows PHP Local File Inclusion.This issue affects Image Gallery Box by CRUDLab: from n/a through <= 1.0.3.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23932

WordPress Quick Count Plugin <= 3.00 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Marko-M Quick Count quick-count allows Object Injection.This issue affects Quick Count: from n/a through <= 3.00.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:04 WIB

Official record

CritPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23931

WordPress WordPress Local SEO plugin <= 2.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Oliver Fuhrmann WordPress Local SEO dh-local-seo allows Blind SQL Injection.This issue affects WordPress Local SEO: from n/a through <= 2.3.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:06 WIB

Official record

CritPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23921

WordPress Multi Uploader for Gravity Forms plugin <= 1.1.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in sh1zen Multi Uploader for Gravity Forms gf-multi-uploader allows Upload a Web Shell to a Web Server.This issue affects Multi Uploader for Gravity Forms: from n/a through <= 1.1.3.

Excerpt language: en.

CVSS9v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:06 WIB

Official record

CritPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23918

WordPress Smallerik File Browser plugin <= 1.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Enrico Sandoli Smallerik File Browser smallerik-file-browser allows Upload a Web Shell to a Web Server.This issue affects Smallerik File Browser: from n/a through <= 1.1.

Excerpt language: en.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23910

WordPress Menus Plus+ Plugin <= 1.9.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in keighl Menus Plus+ menus-plus allows SQL Injection.This issue affects Menus Plus+: from n/a through <= 1.9.6.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:45 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23874

WordPress WP Block Pack plugin <= 1.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FalconTheme Team WP Block Pack wp-block-pack allows Reflected XSS.This issue affects WP Block Pack: from n/a through <= 1.1.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:44 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23867

WordPress WordPress File Search Plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markcoker WordPress File Search wpfilesearch allows Reflected XSS.This issue affects WordPress File Search: from n/a through <= 1.2.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:02 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23866

WordPress EU DSGVO Helper Plugin <= 1.0.6.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E. Marten EU DSGVO Helper dsgvo allows Reflected XSS.This issue affects EU DSGVO Helper: from n/a through <= 1.0.6.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23811

WordPress WP2APP Plugin <= 2.6.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ghasemy14 WP2APP wp2appir allows Reflected XSS.This issue affects WP2APP: from n/a through <= 2.6.2.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:03 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23806

WordPress Ultimate Subscribe Plugin <=1.3 - CSRF to Reflected Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ThemeFarmer Ultimate Subscribe ultimate-subscribe allows Reflected XSS.This issue affects Ultimate Subscribe: from n/a through <= 1.3.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23803

WordPress Snippy Plugin <= 1.4.1 - CSRF to Cross Site Scripting (XSS) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Rik Schennink Snippy snippy allows Reflected XSS.This issue affects Snippy: from n/a through <= 1.4.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:05 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23798

WordPress Mass Messaging in BuddyPress Plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ElbowRobo Mass Messaging in BuddyPress mass-messaging-in-buddypress allows Reflected XSS.This issue affects Mass Messaging in BuddyPress: from n/a through <= 2.2.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:04 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23784

WordPress Contact Form 7 Round Robin Lead Distribution Plugin <= 1.2.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Jeffrey Contact Form 7 Round Robin Lead Distribution contact-form-7-round-robin-lead-distribution allows SQL Injection.This issue affects Contact Form 7 Round Robin Lead Distribution: from n/a through <= 1.2.1.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

HighPublished 22 Jan 2025, 21:29 WIB

CVE-2025-23781

WordPress WM Options Import Export plugin <= 1.0.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Web Mumbai WM Options Import Export wm-options-import-export allows Retrieve Embedded Sensitive Data.This issue affects WM Options Import Export: from n/a through <= 1.0.1.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:07 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage