Explore CVE records

HighPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46242

WordPress Watu Quiz plugin <= 3.4.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bob Watu Quiz watu allows SQL Injection.This issue affects Watu Quiz: from n/a through <= 3.4.3.

Excerpt language: en.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46241

WordPress Appointment Booking Calendar plugin <= 1.3.92 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in codepeople Appointment Booking Calendar appointment-booking-calendar allows SQL Injection.This issue affects Appointment Booking Calendar: from n/a through <= 1.3.92.

Excerpt language: en.

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46240

WordPress Simple Download Counter plugin <= 2.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Simple Download Counter simple-download-counter allows Stored XSS.This issue affects Simple Download Counter: from n/a through <= 2.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46239

WordPress Theme Switcha plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr Theme Switcha theme-switcha allows Stored XSS.This issue affects Theme Switcha: from n/a through <= 3.4.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46238

WordPress List Last Changes plugin <= 1.2.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rbaer List Last Changes list-last-changes allows Stored XSS.This issue affects List Last Changes: from n/a through <= 1.2.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46237

WordPress Link Library plugin <= 7.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Stored XSS.This issue affects Link Library: from n/a through <= 7.8.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46236

WordPress HTML Forms plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Software LLC HTML Forms html-forms allows Stored XSS.This issue affects HTML Forms: from n/a through <= 1.5.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46235

WordPress SKT Blocks – Gutenberg based Page Builder plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 2.0.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46233

WordPress Sirv plugin <= 7.5.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sirv CDN and Image Hosting Sirv sirv allows Stored XSS.This issue affects Sirv: from n/a through <= 7.5.3.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46232

WordPress Download Alt Text AI plugin <= 1.9.93 - Broken Access Control Vulnerability

Missing Authorization vulnerability in alttextai Download Alt Text AI alttext-ai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download Alt Text AI: from n/a through <= 1.9.93.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46231

WordPress affiliate-toolkit plugin <= 3.7.3 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in SERVIT Software Solutions affiliate-toolkit affiliate-toolkit-starter allows Cross Site Request Forgery.This issue affects affiliate-toolkit: from n/a through <= 3.7.3.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46229

WordPress Textmetrics plugin <= 3.6.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Israpil Textmetrics webtexttool allows Stored XSS.This issue affects Textmetrics: from n/a through <= 3.6.2.

Excerpt language: en.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46228

WordPress Event post plugin <= 5.9.11 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows DOM-Based XSS.This issue affects Event post: from n/a through <= 5.9.11.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46227

WordPress Custom Related Posts plugin <= 1.7.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brecht Custom Related Posts custom-related-posts allows Stored XSS.This issue affects Custom Related Posts: from n/a through <= 1.7.4.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 07:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46226

WordPress MPL-Publisher plugin <= 2.18.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ferranfg MPL-Publisher mpl-publisher allows Stored XSS.This issue affects MPL-Publisher: from n/a through <= 2.18.0.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

MedPublished 22 Apr 2025, 16:53 WIB

CVE-2025-46225

WordPress Post in page for Elementor plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Post in page for Elementor allows DOM-Based XSS. This issue affects Post in page for Elementor: from n/a through 1.0.1.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:12 WIB

Official record

HighPublished 22 Apr 2025, 15:51 WIB

CVE-2025-3519

Replace uploaded files knowing the file upload ID

An authorization bypass in Unblu Spark allows a participant of a conversation to replace an existing, uploaded file. Every uploaded file in Unblu gets assigned with a randomly generated Universally Unique ID (UUID). In case a participant of this or another conversation gets access to such a file ID, it can be used to …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS7v4.0KEVNot listedEPSSPresentUpdated23 Apr 2025, 01:55 WIB

Official record

MedPublished 22 Apr 2025, 15:49 WIB

CVE-2025-3518

File upload functionality possible even when disabled

It technically possible for a user to upload a file to a conversation despite the file upload functionality being disabled. The file upload functionality can be enabled or disabled for specific use cases through configuration. In case the functionality is disabled for at least one use case, the system nevertheless all…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS5.3v4.0KEVNot listedEPSSPresentUpdated24 Apr 2025, 21:59 WIB

Official record

UnscoredPublished 22 Apr 2025, 14:07 WIB

CVE-2025-26413

Apache Kvrocks: The server was crashed by the negative offset

Improper Input Validation vulnerability in Apache Kvrocks. The SETRANGE command didn't check if the `offset` input is a positive integer and use it as an index of a string. So it will cause the server to crash due to its index is out of range. This issue affects Apache Kvrocks: through 2.11.1. Users are recommended …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

CVSS—KEVNot listedEPSSPresentUpdated12 May 2025, 22:47 WIB

Official record

UnscoredPublished 22 Apr 2025, 13:00 WIB

CVE-2025-2594

User Registration & Membership < 4.1.3 - Authentication Bypass

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.

Excerpt language: en.

CVSS—KEVNot listedEPSSPresentUpdated27 Aug 2025, 19:00 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage