Explore CVE records

HighPublished 04 Jul 2025, 18:18 WIB

CVE-2025-49247

WordPress Team Showcase plugin < 25.05.13 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Team Showcase team-showcase-cm allows DOM-Based XSS.This issue affects Team Showcase: from n/a through < 25.05.13.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 04 Jul 2025, 18:18 WIB

CVE-2025-49274

WordPress Neom Blog theme <= 0.0.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awordpresslife Neom Blog neom-blog allows Reflected XSS.This issue affects Neom Blog: from n/a through <= 0.0.9.

Excerpt language: en.

CritPublished 04 Jul 2025, 18:18 WIB

CVE-2025-49302

WordPress Easy Stripe plugin <= 1.1 - Remote Code Execution (RCE) Vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe easy-stripe allows Remote Code Inclusion.This issue affects Easy Stripe: from n/a through <= 1.1.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:28 WIB

Official record

MedPublished 04 Jul 2025, 18:18 WIB

CVE-2025-49303

WordPress Frontend Admin by DynamiApps plugin <= 3.28.7 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-element allows Path Traversal.This issue affects Frontend Admin by DynamiApps: from n/a through <= 3.28.7.

Excerpt language: en.

CVSS6.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:28 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-49866

WordPress Beautiful Cookie Consent Banner plugin <= 4.6.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-responsive-cookie-consent allows Reflected XSS.This issue affects Beautiful Cookie Consent Banner: from n/a through <= 4.6.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 16:51 WIB

Official record

CritPublished 04 Jul 2025, 18:17 WIB

CVE-2025-49867

WordPress RealHomes theme <= 4.4.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <= 4.4.0.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-49870

WordPress Paid Member Subscriptions plugin <= 2.15.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows SQL Injection.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.1.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:28 WIB

Official record

MedPublished 04 Jul 2025, 18:17 WIB

CVE-2025-50032

WordPress Paytiko for WooCommerce plugin <= 1.3.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paytiko for WooCommerce: from n/a through <= 1.3.21.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

MedPublished 04 Jul 2025, 18:17 WIB

CVE-2025-50039

WordPress VG WORT METIS plugin <= 2.0.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VG WORT METIS: from n/a through <= 2.0.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52718

WordPress Alone theme <= 7.8.2 - Arbitrary Code Execution Vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Remote Code Inclusion.This issue affects Alone: from n/a through <= 7.8.2.

Excerpt language: en.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52776

WordPress Video List Manager plugin <= 1.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows Stored XSS.This issue affects Video List Manager: from n/a through <= 1.7.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52796

WordPress WP-Recall <= 16.26.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affects WP-Recall: from n/a through 16.26.14.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52798

WordPress JobSearch plugin < 3.0.6 - Reflected Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through < 3.0.6.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52805

WordPress Leyka plugin <= 3.32.1 - Local File Inclusion vulnerability

Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52807

WordPress Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme kossy allows PHP Local File Inclusion.This issue affects Kossy - Minimalist eCommerce WordPress Theme: from n/a through <= 1.45.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52813

WordPress MobiLoud <= 4.6.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in pietro MobiLoud allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MobiLoud: from n/a through 4.6.5.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

HighPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52828

WordPress Red Art theme <= 3.8 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:28 WIB

Official record

CritPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52830

WordPress bSecure – Your Universal Checkout plugin <= 1.7.9 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bSecure – Your Universal Checkout bSecure – Your Universal Checkout bsecure allows Blind SQL Injection.This issue affects bSecure – Your Universal Checkout: from n/a through <= 1.7.9.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

CritPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52831

WordPress Video List Manager plugin <= 1.7 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

CritPublished 04 Jul 2025, 18:17 WIB

CVE-2025-52832

WordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows SQL Injection.This issue affects NGG Smart Image Search: from n/a through <= 3.4.1.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:13 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage