Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2025-60212

WordPress VEDA Theme <= 4.2 - PHP Object Injection Vulnerability

Deserialization of Untrusted Data vulnerability in designthemes VEDA veda allows Object Injection.This issue affects VEDA: from n/a through <= 4.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-69187

WordPress Final User plugin <= 1.2.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through <= 1.2.5.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Final User Wordpress
CVE-2025-69186

WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Hospital & Doctor Directory Wordpress
CVE-2025-60211

WordPress WooCommerce Registration Fields Plugin - Custom Signup Fields plugin <= 3.2.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Privilege Escalation.This issue affects WooCommerce Registration Fields Plugin - Custom Signup Fields: from n/a through <= 3.2.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Extendons Woocommerce Wordpress
Products
Woocommerce Registration Fields Plugin Woocommerce Wordpress
CVE-2025-60209

WordPress Connector for Gravity Forms and Google Sheets plugin <= 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in CRM Perks Connector for Gravity Forms and Google Sheets wp-gravity-forms-spreadsheets allows Object Injection.This issue affects Connector for Gravity Forms and Google Sheets: from n/a through <= 1.2.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-60208

WordPress Advanced Custom Fields : CPT Options Pages plugin <= 2.0.9 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Tusko Trush Advanced Custom Fields : CPT Options Pages acf-cpt-options-pages allows Object Injection.This issue affects Advanced Custom Fields : CPT Options Pages: from n/a through <= 2.0.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-60207

WordPress Custom User Registration Fields for WooCommerce plugin <= 2.1.2 - Arbitrary File Upload Vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Addify Custom User Registration Fields for WooCommerce user-registration-plugin-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects Custom User Registration Fields for WooCommerce: from n/a through <= 2.1.2.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Addify Woocommerce Wordpress
Products
Custom User Registration Fields For Woocommerce Woocommerce Wordpress
CVE-2025-69185

WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-69184

WordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3.4.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Institutions Directory Wordpress
CVE-2025-69183

WordPress Hospital Doctor Directory plugin <= 1.3.9 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Hospital & Doctor Directory Wordpress
CVE-2025-60206

WordPress Alone theme <= 7.8.3 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through <= 7.8.3.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-60195

WordPress Atarim plugin <= 4.2.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Privilege Escalation.This issue affects Atarim: from n/a through <= 4.2.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Atarim Wordpress
Products
Atarim Wordpress
CVE-2025-69182

WordPress Institutions Directory plugin <= 1.3.4 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institutions Directory: from n/a through <= 1.3.4.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Institutions Directory Wordpress
CVE-2025-69181

WordPress Lawyer Directory plugin <= 1.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.4.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Lawyer Directory Wordpress
CVE-2025-60187

WordPress Atarim plugin <= 4.2.1 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Using Malicious Files.This issue affects Atarim: from n/a through <= 4.2.1.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Atarim Wordpress
Products
Atarim Wordpress
CVE-2025-68997

WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-69001

WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Shahjahan Jewel FluentForm fluentform allows Code Injection.This issue affects FluentForm: from n/a through <= 6.1.11.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-69002

WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Designthemes Wordpress
Products
Onelife Wordpress
CVE-2025-69003

WordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes KenthaRadio qt-kentharadio allows Reflected XSS.This issue affects KenthaRadio: from n/a through <= 2.2.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Qantumthemes Wordpress
Products
Kentharadio Wordpress
CVE-2025-69004

WordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme <= 2.1.0 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in XpeedStudio Bajaar - Highly Customizable WooCommerce WordPress Theme bajaar allows PHP Local File Inclusion.This issue affects Bajaar - Highly Customizable WooCommerce WordPress Theme: from n/a through <= 2.1.0.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Woocommerce Wordpress Xpeedstudio
Products
Woocommerce Wordpress Bajaar - Highly Customizable Woocommerce Wordpress Theme