Explore CVE records

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30788

WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.25.08 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows SQL Injection.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.

Excerpt language: en.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30787

WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.25.08 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a through <= 5.25.08.

Excerpt language: en.

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30786

WordPress Quotes llama plugin <= 3.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oooorgle Quotes llama quotes-llama allows DOM-Based XSS.This issue affects Quotes llama: from n/a through <= 3.1.0.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30785

WordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion Vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through <= 1.2.9.

Excerpt language: en.

CVSS7.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30784

WordPress WP Subscription Forms plugin <= 1.2.3 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows SQL Injection.This issue affects WP Subscription Forms: from n/a through <= 1.2.3.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30783

WordPress WP Google Review Slider plugin <= 16.0 - CSRF to SQL Injection vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in jgwhite33 WP Google Review Slider wp-google-places-review-slider allows SQL Injection.This issue affects WP Google Review Slider: from n/a through <= 16.0.

Excerpt language: en.

CVSS8.2v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30781

WordPress Scheduled & Automatic Order Status Controller for WooCommerce plugin <= 3.7.1 - Open Redirection Vulnerability

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in WPFactory Scheduled & Automatic Order Status Controller for WooCommerce order-status-rules-for-woocommerce allows Phishing.This issue affects Scheduled & Automatic Order Status Controller for WooCommerce: from n/a through <= 3.7.1.

Excerpt language: en.

CVSS4.7v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30780

WordPress Audio Album plugin <= 1.5.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cubecolour Audio Album audio-album allows Stored XSS.This issue affects Audio Album: from n/a through <= 1.5.0.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30779

WordPress Doneren met Mollie plugin <= 2.10.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick van Wobbie Doneren met Mollie doneren-met-mollie allows Stored XSS.This issue affects Doneren met Mollie: from n/a through <= 2.10.7.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30777

WordPress Support Genix plugin <= 1.4.11 - Insecure Direct Object References (IDOR) Vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Support Genix: from n/a through <= 1.4.11.

Excerpt language: en.

CVSS4.3v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30776

WordPress Sitekit plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Sitekit sitekit allows Stored XSS.This issue affects Sitekit: from n/a through <= 1.8.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30775

WordPress WPGuppy plugin <= 1.1.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows SQL Injection.This issue affects WPGuppy: from n/a through <= 1.1.3.

Excerpt language: en.

CVSS8.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30773

WordPress TranslatePress plugin <= 2.9.6 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.

Excerpt language: en.

CVSS7.2v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30771

WordPress WP Cassify plugin <= 2.3.5 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alain-Aymerick FRANCOIS WP Cassify wp-cassify allows DOM-Based XSS.This issue affects WP Cassify: from n/a through <= 2.3.5.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30770

WordPress Charitable plugin <= 1.8.4.7 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Charitable charitable allows DOM-Based XSS.This issue affects Charitable: from n/a through <= 1.8.4.7.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30769

WordPress WIP WooCarousel Lite plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in alexvtn WIP WooCarousel Lite wip-woocarousel-lite allows Stored XSS.This issue affects WIP WooCarousel Lite: from n/a through <= 1.1.7.

Excerpt language: en.

CVSS7.1v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

HighPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30772

WordPress WPC Smart Upsell Funnel for WooCommerce plugin <= 3.0.4 - Arbitrary Option Update to Privilege Escalation vulnerability

Missing Authorization vulnerability in WPClever WPC Smart Upsell Funnel for WooCommerce wpc-smart-upsell-funnel allows Privilege Escalation.This issue affects WPC Smart Upsell Funnel for WooCommerce: from n/a through <= 3.0.4.

Excerpt language: en.

CVSS8.8v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30768

WordPress jAlbum Bridge plugin <= 2.0.18 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows Stored XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.18.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30767

WordPress PDF for WPForms plugin <= 5.3.0 - Arbitrary Shortcode Execution vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.3.0.

Excerpt language: en.

CVSS5.4v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

MedPublished 27 Mar 2025, 17:54 WIB

CVE-2025-30766

WordPress Happy Addons for Elementor plugin <= 3.16.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyMonster Happy Addons for Elementor happy-elementor-addons allows DOM-Based XSS.This issue affects Happy Addons for Elementor: from n/a through <= 3.16.2.

Excerpt language: en.

CVSS6.5v3.1KEVNot listedEPSSPresentUpdated28 Apr 2026, 23:11 WIB

Official record

Find the CVE cohort

Severity

Matching records by UTC month

Signal coverage

Find the CVE cohort

Matching cohort composition

Severity

Matching records by UTC month

Signal coverage