Skip to main content

CVKevelryresearch console

Overview Search (current)Priority4 views Radar Replay Method API

Data status

Source freshnessstatus Referencev1

Display

Display timezone

Search/all sources

⌘K

Data status Explore

SearchRetained snapshotUTC filters

Find the CVE cohort

Identifier and description search over the retained local snapshot. Filters apply to the cohort immediately; every chart links back into the same filter state.

Scoring rules API reference

Filters1 active

Published date range Compares the stored publication timestamp in UTC. The start binds inclusively, the end exclusively. Records with an unknown publication date are excluded as soon as either bound is set; they never match a bounded range.

From · UTC→Before · UTC

Start inclusive, end exclusive. Unknown dates are excluded from any bounded range.

Severity bands, primary CNA metric with version labels Bands come from the primary CNA CVSS only. ADP-only and metric-less records land in Unscored. CVSS v2-only records are Legacy and are never compared with v3/v4 scores.

Critical · 9.0–10.0High · 7.0–8.9Medium · 4.0–6.9Low · 0.1–3.9None · scored 0.0Legacy · v2 onlyUnscored · no CNA metric

Known-exploited membership Membership in the accepted CISA snapshot. Absence is not proof of no exploitation. The date added is the catalog date, not the date of first exploitation.

Any KEV statusKEV-listed onlyNot KEV-listed

Forecast presence, same snapshot, same model Dated forecast presence for this snapshot's model and score date — not severity, not popularity. Absent means no current row, never zero.

Any forecast statusForecast presentForecast unavailable

Results per page Bounded page size. Totals and cohort coverage may exceed the returned page.Clear filters

Matching cohort

Matching cohort: 4,273 published records · 17 KEV · 4,273 with a forecast · 0 unknown dates

Ordering & coverage

Search ordering: text queries rank by the local index, then CVE ID. Empty queries sort publication date descending with unknown dates last. Severity bands narrow the cohort after the text, date, and signal match. Excerpts are capped at 320 code points. Coverage is exact over the matching cohort.

Matching cohort composition

Cohort composition

4,273 matching published records · 0 with an unknown publication date

Every segment and month is a link that preserves the other filters.

Severity

Crit2375.5%
High1,05525%
Med1,75941%
Low751.8%
None20.05%
Legacy00.00%
Unscored1,14527%

Matching records by UTC month

Jan 254,273

Signal coverage

KEV-listed: 17
With a forecast: 4,273
Unknown date: 0
Unscored severity: 1,145

Share of cohort: KEV 0.40% · forecast 100% · unscored 27%.

Showing 861–880 of 4,273By severity band: Critical · 9.0–10.0 237, High · 7.0–8.9 1,055, Medium · 4.0–6.9 1,759, Low · 0.1–3.9 75, None · scored 0.0 2, Legacy · v2 only 0, Unscored · no CNA metric 1,145

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24658

WordPress Auction Nudge – Your eBay on Your Site plugin <= 7.2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Auction Nudge – Your eBay on Your Site auction-nudge allows Stored XSS.This issue affects Auction Nudge – Your eBay on Your Site: from n/a through <= 7.2.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:47.058Z. Updated 2026-05-12T23:47:22.207Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:47 WIB

Official record

HighPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24672

WordPress Form Builder CP Plugin <= 1.2.41 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in codepeople Form Builder CP cp-easy-form-builder allows SQL Injection.This issue affects Form Builder CP: from n/a through <= 1.2.41.

Excerpt language: en.

Severity high: primary CNA CVSS 8.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:46.086Z. Updated 2026-04-28T16:11:31.660Z.

Showing 861 to 880 of 4273.First page Next page

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24668

WordPress PPOM for WooCommerce plugin <= 33.0.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle PPOM for WooCommerce woocommerce-product-addon allows Stored XSS.This issue affects PPOM for WooCommerce: from n/a through <= 33.0.8.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:45.470Z. Updated 2026-04-28T16:11:31.622Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24659

WordPress Premium Packages – Sell Digital Products Securely plugin <= 5.9.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Blind SQL Injection.This issue affects WPDM – Premium Packages: from n/a through <= 5.9.6.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:44.883Z. Updated 2026-04-28T16:11:31.615Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24649

WordPress Admin and Site Enhancements (ASE) Plugin <= 7.6.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Admin and Site Enhancements (ASE): from n/a through <= 7.6.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:44.275Z. Updated 2026-05-11T23:15:24.832Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:15 WIB

Official record

HighPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24663

WordPress Simple Download Monitor plugin <= 3.9.25 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mra13 Simple Download Monitor simple-download-monitor allows Blind SQL Injection.This issue affects Simple Download Monitor: from n/a through <= 3.9.25.

Excerpt language: en.

Severity high: primary CNA CVSS 7.6 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:43.701Z. Updated 2026-05-12T23:46:53.216Z.

CVSS7.6v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:46 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24657

WordPress Wishlist for WooCommerce plugin <=2.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee Wishlist for WooCommerce wt-woocommerce-wishlist allows Stored XSS.This issue affects Wishlist for WooCommerce: from n/a through <= 2.1.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:43.101Z. Updated 2026-04-28T16:11:31.311Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24644

WordPress WooCommerce PDF Invoices plugin <= 4.7.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels print-invoices-packing-slip-labels-for-woocommerce allows Stored XSS.This issue affects WooCommerce PDF Invoices, Packing Slips, Del…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:42.511Z. Updated 2026-04-28T16:11:31.103Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24647

WordPress WooCommerce Cloak Affiliate Links plugin <= 1.0.35 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in datafeedr WooCommerce Cloak Affiliate Links woocommerce-cloak-affiliate-links allows Cross Site Request Forgery.This issue affects WooCommerce Cloak Affiliate Links: from n/a through <= 1.0.35.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:41.931Z. Updated 2026-04-28T16:11:31.267Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

CritPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24650

WordPress Tourfic plugin <= 2.15.3 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Themefic Tourfic tourfic allows Upload a Web Shell to a Web Server.This issue affects Tourfic: from n/a through <= 2.15.3.

Excerpt language: en.

Severity critical: primary CNA CVSS 9.1 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:41.337Z. Updated 2026-04-28T16:11:31.284Z.

CVSS9.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24625

WordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin <= 5.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and Role based Discounts for WooCommerce: from n/a through <= 5.1…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:40.728Z. Updated 2026-05-11T23:17:46.360Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:17 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24623

WordPress Really Simple Security plugin <= 9.1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Cross Site Request Forgery.This issue affects Really Simple SSL: from n/a through <= 9.1.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:40.116Z. Updated 2026-05-11T23:17:23.337Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:17 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24638

WordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through <= 1.4.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:39.547Z. Updated 2026-04-28T16:11:30.779Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24627

WordPress Blur Text Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through <= 1.0.0.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:38.980Z. Updated 2026-05-12T23:49:07.790Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:49 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24652

WordPress WP Duplicate plugin <= 1.1.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in revmakx WP Duplicate local-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Duplicate: from n/a through <= 1.1.6.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:38.393Z. Updated 2026-04-28T16:11:31.280Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24634

WordPress Orbisius Simple Notice plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.9 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:37.851Z. Updated 2026-04-28T16:11:30.731Z.

CVSS5.9v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24613

WordPress FV Thoughtful Comments plugin <= 0.3.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:37.249Z. Updated 2026-05-12T23:49:37.573Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:49 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24610

WordPress Restrict Anonymous Access Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1.2.

Excerpt language: en.

Severity medium: primary CNA CVSS 6.5 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:36.657Z. Updated 2026-05-11T23:16:24.305Z.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated12 May 2026, 06:16 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24622

WordPress Job Board Manager plugin <= 2.1.59 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Job Board Manager job-board-manager allows Cross Site Request Forgery.This issue affects Job Board Manager: from n/a through <= 2.1.59.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:36.074Z. Updated 2026-05-12T23:46:38.762Z.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated13 May 2026, 06:46 WIB

Official record

MedPublished 25 Jan 2025, 00:24 WIB

CVE-2025-24618

WordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.3.1.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-24T17:24:35.505Z. Updated 2026-04-28T16:11:30.421Z.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record