Explore CVE records

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47660

WordPress WC Affiliate plugin <= 2.16 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Codexpert, Inc WC Affiliate wc-affiliate allows Object Injection.This issue affects WC Affiliate: from n/a through <= 2.16.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 23 May 2025, 19:43 WIB

CVE-2025-47663

WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in mojoomla Hospital Management System allows Upload a Web Shell to a Web Server. This issue affects Hospital Management System: from 47.0(20 through 11.

Excerpt language: en.

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47670

WordPress Social Login and Register plugin <= 7.6.10 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social Login and Register: from n/a through <= 7.6.10.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47671

WordPress Binary MLM Plan plugin <= 3.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LETSCMS MLM Software Binary MLM Plan binary-mlm-plan allows SQL Injection.This issue affects Binary MLM Plan: from n/a through <= 3.0.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47672

WordPress miniOrange Discord Integration plugin <= 2.2.2 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange miniOrange Discord Integration miniorange-discord-integration allows PHP Local File Inclusion.This issue affects miniOrange Discord Integration: from n/a through <= 2.2.2.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47673

WordPress Arconix Shortcodes plugin <= 2.1.16 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Reflected XSS.This issue affects Arconix Shortcodes: from n/a through <= 2.1.16.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47678

WordPress FunnelCockpit plugin <= 1.4.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Reflected XSS.This issue affects FunnelCockpit: from n/a through <= 1.4.3.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:20 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47680

WordPress xili-tidy-tags plugin <= 1.12.06 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-tidy-tags xili-tidy-tags allows Reflected XSS.This issue affects xili-tidy-tags: from n/a through <= 1.12.06.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 23 May 2025, 19:43 WIB

CVE-2025-47687

WordPress StoreKeeper for WooCommerce plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.

Excerpt language: en.

CVSS10v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-47690

WordPress Lead Form Data Collection to CRM plugin <= 3.1 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in Smackcoders Inc., Lead Form Data Collection to CRM wp-leads-builder-any-crm allows Privilege Escalation.This issue affects Lead Form Data Collection to CRM: from n/a through <= 3.1.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-48241

WordPress Verge3D plugin <= 4.9.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soft8Soft LLC Verge3D verge3d allows Reflected XSS.This issue affects Verge3D: from n/a through <= 4.9.3.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-48245

WordPress Quick Contact Form plugin <= 8.2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows Reflected XSS.This issue affects Quick Contact Form: from n/a through <= 8.2.1.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 23 May 2025, 19:43 WIB

CVE-2025-48271

WordPress Leadinfo plugin <= 1.1 - Settings Change Vulnerability

Missing Authorization vulnerability in Leadinfo Leadinfo leadinfo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadinfo: from n/a through <= 1.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-48273

WordPress WP Job Portal plugin <= 2.3.2 - Arbitrary File Download Vulnerability

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in wpjobportal WP Job Portal wp-job-portal allows Path Traversal.This issue affects WP Job Portal: from n/a through <= 2.3.2.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:20 WIB

Official record

MedPublished 23 May 2025, 19:43 WIB

CVE-2025-48275

WordPress Visual Header plugin <= 1.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in dastan800 Visual Header visual-header allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Visual Header: from n/a through <= 1.3.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 23 May 2025, 19:43 WIB

CVE-2025-48283

WordPress Majestic Support plugin <= 1.1.0 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Majestic Support Majestic Support majestic-support allows SQL Injection.This issue affects Majestic Support: from n/a through <= 1.1.0.

Excerpt language: en.

CVSS9.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-48286

WordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catkin ReDi Restaurant Reservation redi-restaurant-reservation allows Reflected XSS.This issue affects ReDi Restaurant Reservation: from n/a through <= 24.1209.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 23 May 2025, 19:43 WIB

CVE-2025-48287

WordPress Pix 4x sem juros - Pagaleve plugin <= 1.6.9 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Pagaleve Pix 4x sem juros - Pagaleve wc-pagaleve allows Object Injection.This issue affects Pix 4x sem juros - Pagaleve: from n/a through <= 1.6.9.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

CritPublished 23 May 2025, 19:43 WIB

CVE-2025-48289

WordPress Kids Planet theme <= 2.2.14 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in AncoraThemes Kids Planet kidsplanet allows Object Injection.This issue affects Kids Planet: from n/a through <= 2.2.14.

Excerpt language: en.

CVSS9.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 23 May 2025, 19:43 WIB

CVE-2025-48292

WordPress Tourmaster plugin <= 5.3.8 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in GoodLayers Tourmaster tourmaster allows PHP Local File Inclusion.This issue affects Tourmaster: from n/a through <= 5.3.8.

Excerpt language: en.

CVSS8.1v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:20 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage