Explore CVE records

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69022

WordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69021

WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.

Excerpt language: en.

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69020

WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:33 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69019

WordPress FlippingBook plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affects FlippingBook: from n/a through <= 2.0.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:33 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69018

WordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:33 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69017

WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69016

WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerability

Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated07 Oct 2026, 21:58 WIB

Official record

LowPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69015

WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.

Excerpt language: en.

CVSS3.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69014

WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.

Excerpt language: en.

CVSS4.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69013

WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69012

WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69010

WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:32 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69009

WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69008

WordPress Inboxify Sign Up Form plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allows Stored XSS.This issue affects Inboxify Sign Up Form: from n/a through <= 1.0.4.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:32 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69007

WordPress Popping Sidebars and Widgets Light plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Stored XSS.This issue affects Popping Sidebars and Widgets Light: from n/a through <= 1.27.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:32 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-69006

WordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This issue affects AM Events: from n/a through <= 1.13.1.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:31 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-68998

WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-68997

WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.

Excerpt language: en.

CVSS5.3v3.1KEVNot listedEPSSPresentUpdated29 Apr 2026, 03:13 WIB

Official record

HighPublished 30 Dec 2025, 17:47 WIB

CVE-2025-68996

WordPress Responsive Posts Carousel Pro plugin <= 15.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebCodingPlace Responsive Posts Carousel Pro responsive-posts-carousel-pro allows PHP Local File Inclusion.This issue affects Responsive Posts Carousel Pro: from n/a through <= 15.1.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

MedPublished 30 Dec 2025, 17:47 WIB

CVE-2025-68995

WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:14 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage