Explore CVE records

HighPublished 20 May 2025, 00:29 WIB

CVE-2025-43833

WordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a through <= 1.1.1.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 20 May 2025, 00:27 WIB

CVE-2025-43834

WordPress cookieBAR plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue affects cookieBAR: from n/a through <= 1.7.0.

Excerpt language: en.

MedPublished 20 May 2025, 00:26 WIB

CVE-2025-43835

WordPress wp-cyr-cho plugin <= 0.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ktsvetkov wp-cyr-cho wp-cyr-cho allows Cross Site Request Forgery.This issue affects wp-cyr-cho: from n/a through <= 0.1.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:18 WIB

Official record

MedPublished 20 May 2025, 00:25 WIB

CVE-2025-39412

WordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 20 May 2025, 00:22 WIB

CVE-2025-39398

WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 20 May 2025, 00:15 WIB

CVE-2025-39396

WordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 20 May 2025, 00:08 WIB

CVE-2025-43841

WordPress WP Vegas plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider allows Stored XSS.This issue affects WP Vegas: from n/a through <= 2.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 20 May 2025, 00:07 WIB

CVE-2025-43840

WordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 20 May 2025, 00:06 WIB

CVE-2025-46262

WordPress Mad Mimi for WordPress plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Mad Mimi for WordPress mad-mimi allows Stored XSS.This issue affects Mad Mimi for WordPress: from n/a through <= 1.5.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 20 May 2025, 00:05 WIB

CVE-2025-46263

WordPress Author Box After Posts plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lloyd Saunders Author Box After Posts author-box-after-posts allows Stored XSS.This issue affects Author Box After Posts: from n/a through <= 1.6.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 20 May 2025, 00:04 WIB

CVE-2025-46543

WordPress Enhanced Paypal Shortcodes plugin <= 0.5a - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CharlyLeetham Enhanced Paypal Shortcodes enhanced-paypal-shortcodes allows Stored XSS.This issue affects Enhanced Paypal Shortcodes: from n/a through <= 0.5a.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

LowPublished 20 May 2025, 00:03 WIB

CVE-2025-4945

Libsoup: integer overflow in cookie expiration date handling in libsoup

A flaw was found in the cookie parsing logic of the libsoup HTTP library, used in GNOME applications and other software. The vulnerability arises when processing the expiration date of cookies, where a specially crafted value can trigger an integer overflow. This may result in undefined behavior, allowing an attacker t…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS3.7v3.1KEVNot listedEPSSPresentUpdated30 Jun 2026, 17:40 WIB

Official record

MedPublished 20 May 2025, 00:00 WIB

CVE-2025-4941

PHPGurukul Credit Card Application Management System index.php sql injection

A vulnerability, which was classified as critical, was found in PHPGurukul Credit Card Application Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been dis…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.9v4.0KEVNot listedEPSSPresentUpdated20 May 2025, 21:06 WIB

Official record

MedPublished 19 May 2025, 23:51 WIB

CVE-2025-39394

WordPress AnalyticsWP plugin <= 2.1.2 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Solid Plugins AnalyticsWP allows Retrieve Embedded Sensitive Data.This issue affects AnalyticsWP: from n/a through 2.1.2.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 19 May 2025, 23:50 WIB

CVE-2025-26920

WordPress Customify theme <= 0.4.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in pressmaximum Customify customify-theme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customify: from n/a through <= 0.4.8.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 19 May 2025, 23:48 WIB

CVE-2025-26867

WordPress Bulk theme <= 1.0.11 - Broken Access Control vulnerability

Missing Authorization vulnerability in Themes4WP Bulk allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk: from n/a through 1.0.11.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 19 May 2025, 23:47 WIB

CVE-2025-39388

WordPress AnalyticsWP plugin <= 2.0.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Solid Plugins AnalyticsWP allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AnalyticsWP: from n/a through 2.0.0.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 19 May 2025, 23:46 WIB

CVE-2025-39376

WordPress Car Park Booking System for WordPress plugin <= 2.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in QuanticaLabs Car Park Booking System for WordPress car-park-booking-system-for-wordpress.This issue affects Car Park Booking System for WordPress: from n/a through <= 2.6.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 19 May 2025, 23:45 WIB

CVE-2025-39375

WordPress Easy Child Theme Creator plugin <= 1.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Ashok G Easy Child Theme Creator easy-child-theme-creator allows Cross Site Request Forgery.This issue affects Easy Child Theme Creator: from n/a through <= 1.3.1.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:17 WIB

Official record

HighPublished 19 May 2025, 23:44 WIB

CVE-2025-39374

WordPress Best Posts Summary plugin <= 1.0 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in aseem1234 Best Posts Summary best-posts-summary allows Stored XSS.This issue affects Best Posts Summary: from n/a through <= 1.0.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage