Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,033 published records · 16 KEV · 4,033 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,033 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2115.2%
High1,29032%
Med1,73543%
Low1343.3%
None30.07%
Legacy00.00%
Unscored66016%

Matching records by UTC month

Apr 254,033

Signal coverage

KEV-listed: 16
With a forecast: 4,033
Unknown date: 0
Unscored severity: 660

Share of cohort: KEV 0.40% · forecast 100% · unscored 16%.

Showing 481–500 of 4,033By severity band: Critical · 9.0–10.0 211, High · 7.0–8.9 1,290, Medium · 4.0–6.9 1,735, Low · 0.1–3.9 134, None · scored 0.0 3, Legacy · v2 only 0, Unscored · no CNA metric 660

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46531

WordPress WP AVCL Automation Helper (formerly WPFlyLeads) plugin <= 3.4 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Ankur Vishwakarma WP AVCL Automation Helper (formerly WPFlyLeads) woozap allows Server Side Request Forgery.This issue affects WP AVCL Automation Helper (formerly WPFlyLeads): from n/a through <= 3.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:24.176Z. Updated 2026-04-28T16:12:40.067Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46519

WordPress Media Library Downloader plugin <= 1.3.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in M.Code Media Library Downloader media-library-downloader allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Library Downloader: from n/a through <= 1.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Showing 481 to 500 of 4033.First page Next page

Published 2025-04-24T16:09:23.610Z. Updated 2026-04-28T16:12:39.767Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46511

WordPress BeerXML Shortcode plugin <= 0.7.1 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Derek Springer BeerXML Shortcode beerxml-shortcode allows Server Side Request Forgery.This issue affects BeerXML Shortcode: from n/a through <= 0.7.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:23.029Z. Updated 2026-04-28T16:12:39.705Z.

CVSS6.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46503

WordPress Simple Google Photos Grid plugin <= 1.5 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery (SSRF) vulnerability in josheli Simple Google Photos Grid simple-google-photos-grid allows Server Side Request Forgery.This issue affects Simple Google Photos Grid: from n/a through <= 1.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:22.403Z. Updated 2026-04-28T16:12:39.660Z.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46489

WordPress Bulk Assign Linked Products For WooCommerce plugin <= 2.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in vinodvaswani9 Bulk Assign Linked Products For WooCommerce wc-bulk-assign-linked-products allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bulk Assign Linked Products For WooCommerce: from n/a through <= 2.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:21.826Z. Updated 2026-04-28T16:12:39.160Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46485

WordPress WP Customize Login Page plugin <= 1.6.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:21.243Z. Updated 2026-04-28T16:12:39.210Z.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46477

WordPress WP Customize Login Page plugin <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Carlo La Pera WP Customize Login Page wp-customize-login-page allows Stored XSS.This issue affects WP Customize Login Page: from n/a through <= 1.6.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:20.659Z. Updated 2026-04-28T16:12:38.608Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46469

WordPress Send From plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benjamin Buddle Send From send-from allows Stored XSS.This issue affects Send From: from n/a through <= 2.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:20.096Z. Updated 2026-04-28T16:12:38.699Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46459

WordPress Confirm User Registration plugin <= 2.1.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ralf Hortt Confirm User Registration confirm-user-registration allows Stored XSS.This issue affects Confirm User Registration: from n/a through <= 2.1.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:19.533Z. Updated 2026-05-12T00:13:30.084Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:13 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46451

WordPress Floating Social Bar plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Floating Social Bar floating-social-bar allows Stored XSS.This issue affects Floating Social Bar: from n/a through <= 1.1.7.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:18.875Z. Updated 2026-04-28T16:12:37.593Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46442

WordPress Loan Calculator plugin <= 1.3 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Casey Johnson Loan Calculator repayment-calculator allows Stored XSS.This issue affects Loan Calculator: from n/a through <= 1.3.

Excerpt language: en.

Severity high: primary CNA CVSS 7.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:18.296Z. Updated 2026-05-12T00:13:16.759Z.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:13 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46541

WordPress WP-reCAPTCHA-bp plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elrata_ WP-reCAPTCHA-bp wp-recaptcha-bp allows Stored XSS.This issue affects WP-reCAPTCHA-bp: from n/a through <= 4.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:17.735Z. Updated 2026-04-28T16:12:40.713Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46533

WordPress Landing pages and Domain aliases for WordPress plugin <= 0.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdrift.no Landing pages and Domain aliases for WordPress landing-pages-and-domain-aliases allows Stored XSS.This issue affects Landing pages and Domain aliases for WordPress: from n/a through <= 0.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:17.200Z. Updated 2026-04-28T16:12:40.187Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46529

WordPress Business Contact Widget plugin <= 2.7.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StressFree Sites Business Contact Widget business-contact-widget allows Stored XSS.This issue affects Business Contact Widget: from n/a through <= 2.7.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:16.627Z. Updated 2026-04-28T16:12:40.097Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46525

WordPress WP Cookie Consent plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in msmitley WP Cookie Consent wp-cookie-consent allows Stored XSS.This issue affects WP Cookie Consent: from n/a through <= 1.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:15.981Z. Updated 2026-04-28T16:12:40.074Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46521

WordPress WS Force Login Page plugin <= 3.0.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Silver Muru WS Force Login Page ws-force-login-page allows Stored XSS.This issue affects WS Force Login Page: from n/a through <= 3.0.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:15.417Z. Updated 2026-04-28T16:12:40.067Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46517

WordPress Blog Manager WP plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdiscover Blog Manager WP blog-manager-wp allows Stored XSS.This issue affects Blog Manager WP: from n/a through <= 1.0.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:14.847Z. Updated 2026-04-28T16:12:39.783Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46513

WordPress All in One Time Clock Lite plugin < 1.3.326 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Codebangers All in One Time Clock Lite aio-time-clock-lite allows Cross Site Request Forgery.This issue affects All in One Time Clock Lite: from n/a through < 1.3.326.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:14.256Z. Updated 2026-04-28T16:12:39.649Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46509

WordPress 360 View plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey Mikhalchuk 360 View 360-view allows Stored XSS.This issue affects 360 View: from n/a through <= 1.1.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:13.671Z. Updated 2026-04-28T16:12:39.719Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 24 Apr 2025, 23:09 WIB

CVE-2025-46505

WordPress Peekaboo plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Peekaboo peekaboo allows Stored XSS.This issue affects Peekaboo: from n/a through <= 1.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-04-24T16:09:13.086Z. Updated 2026-04-28T16:12:39.693Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record