Explore CVE records

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58610

WordPress Gallery PhotoBlocks Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:11 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58609

WordPress Latest Post Shortcode Plugin <= 14.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.

Excerpt language: en.

HighPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58608

WordPress MediaPress Plugin <= 1.5.9.1 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:09 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58607

WordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin <= 1.7.11 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR & CCPA Compliance: from n/a through <= 1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:39 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58606

WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.

Excerpt language: en.

CVSS5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:10 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58605

WordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:40 WIB

Official record

HighPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58604

WordPress Mail Mint Plugin <= 1.18.5 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:39 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58603

WordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:38 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58602

WordPress If-So Dynamic Content Personalization Plugin <= 1.9.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.4.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:08 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58601

WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability

Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:40 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58600

WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:07 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58599

WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:40 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58598

WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability

Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce klarna-order-management-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Klarna Order Management for WooCommerce: from n/a through <= 1.9.8.

Excerpt language: en.

CVSS6.6v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:08 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58597

WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:39 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58596

WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:09 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58594

WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability

Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:40 WIB

Official record

MedPublished 03 Sep 2025, 21:36 WIB

CVE-2025-58593

WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 07:10 WIB

Official record

MedPublished 03 Sep 2025, 21:33 WIB

CVE-2025-9823

Reflected XSS in lead:addLeadTags - Quick Add

SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as sessio…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS4.8v4.0KEVNot listedEPSSPresentUpdated04 Sep 2025, 00:33 WIB

Official record

MedPublished 03 Sep 2025, 21:25 WIB

CVE-2025-9824

User Enumeration via Response Timing

ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implementing a timing-safe form login authenticator that ensures c…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 21:46 WIB

Official record

MedPublished 03 Sep 2025, 20:55 WIB

CVE-2025-9822

Secret data extraction via elfinder

SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.

Excerpt language: en.

CVSS5.5v3.1KEVNot listedEPSSPresentUpdated03 Sep 2025, 21:09 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage