Explore CVE records

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-66088

WordPress PropertyHive plugin <= 2.1.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in Property Hive PropertyHive propertyhive allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PropertyHive: from n/a through <= 2.1.12.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

CritPublished 18 Dec 2025, 14:22 WIB

CVE-2025-66078

WordPress Hotel Booking Lite plugin <= 5.2.3 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.

Excerpt language: en.

CritPublished 18 Dec 2025, 14:22 WIB

CVE-2025-66074

WordPress WP Webhooks plugin <= 3.3.8 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Path Traversal.This issue affects WP Webhooks: from n/a through <= 3.3.8.

Excerpt language: en.

CVSS9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-66070

WordPress wpForo Forum plugin <= 2.4.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.10.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 18 Dec 2025, 14:22 WIB

CVE-2025-66068

WordPress InstaWP Connect plugin <= 0.1.1.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in InstaWP InstaWP Connect instawp-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InstaWP Connect: from n/a through <= 0.1.1.9.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-66054

WordPress LearnPress plugin <= 4.2.9.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through <= 4.2.9.4.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64378

WordPress ListingPro theme < 2.9.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in CridioStudio ListingPro listingpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through < 2.9.10.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64377

WordPress ListingPro theme < 2.9.10 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CridioStudio ListingPro listingpro allows PHP Local File Inclusion.This issue affects ListingPro: from n/a through < 2.9.10.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 01:32 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64376

WordPress ListingPro theme < 2.9.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CridioStudio ListingPro listingpro allows Reflected XSS.This issue affects ListingPro: from n/a through < 2.9.10.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 01:32 WIB

Official record

MedPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64375

WordPress WP Social Ninja plugin <= 3.20.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mahmudul Hasan Arif WP Social Ninja wp-social-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Social Ninja: from n/a through <= 3.20.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

CritPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64374

WordPress Motors theme <= 5.6.81 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in StylemixThemes Motors motors allows Using Malicious Files.This issue affects Motors: from n/a through <= 5.6.81.

Excerpt language: en.

CVSS9.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 01:31 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64373

WordPress Traveler theme < 3.2.6 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in shinetheme Traveler traveler allows PHP Local File Inclusion.This issue affects Traveler: from n/a through < 3.2.6.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64372

WordPress Traveler theme < 3.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64371

WordPress Traveler theme < 3.2.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler traveler allows Blind SQL Injection.This issue affects Traveler: from n/a through < 3.2.6.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64295

WordPress All In One SEO Pack plugin <= 4.8.6.1 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Retrieve Embedded Sensitive Data.This issue affects All In One SEO Pack: from n/a through <= 4.8.6.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

MedPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64273

WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64272

WordPress Email marketing for WordPress by GetResponse Official plugin <= 1.5.3 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in GetResponse Email marketing for WordPress by GetResponse Official getresponse-official allows Retrieve Embedded Sensitive Data.This issue affects Email marketing for WordPress by GetResponse Official: from n/a through <= 1.5.3.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 01:29 WIB

Official record

MedPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64270

WordPress Masteriyo - LMS plugin <= 2.0.3 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in masteriyo Masteriyo - LMS learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects Masteriyo - LMS: from n/a through <= 2.0.3.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 01:28 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64268

WordPress Timetics plugin <= 1.0.44 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 01:28 WIB

Official record

HighPublished 18 Dec 2025, 14:22 WIB

CVE-2025-64266

WordPress Booking and Rental Manager plugin <= 2.5.4 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.5.4.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 01:28 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage