Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2025-68072

WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Merv Barrett Wordpress
Products
Easy Property Listings Wordpress
CVE-2025-68050

WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Leadpages Wordpress
Products
Leadpages Wordpress
CVE-2025-68037

WordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Atlasgondal Wordpress
Products
Export Media Urls Wordpress
CVE-2025-68035

WordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-68026

WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability

Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Niaj Morshed Wordpress
Products
Lc Wizard Wordpress
CVE-2025-68024

WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability

Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Addonify Wordpress
Products
Addonify – Woocommerce Wishlist Wordpress
CVE-2025-68012

WordPress CodeColorer plugin <= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects CodeColorer: from n/a through <= 0.10.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-68011

WordPress GLS Shipping for WooCommerce plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GLS GLS Shipping for WooCommerce gls-shipping-for-woocommerce allows Reflected XSS.This issue affects GLS Shipping for WooCommerce: from n/a through <= 1.4.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Gls Woocommerce Wordpress
Products
Shipping For Woocommerce Woocommerce Wordpress
CVE-2025-68010

WordPress Netgsm plugin <= 2.9.63 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Netgsm Wordpress
Products
Netgsm Wordpress
CVE-2025-67991

WordPress User Extra Fields plugin <= 16.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through <= 16.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vanquish Wordpress
Products
User Extra Fields Wordpress
CVE-2025-67990

WordPress GMap Targeting plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 GMap Targeting gmap-targeting allows Reflected XSS.This issue affects GMap Targeting: from n/a through <= 1.1.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Realmag777 Wordpress
Products
Gmap Targeting Wordpress
CVE-2025-67988

WordPress CozyStay theme < 1.9.1 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.9.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Loftocean Wordpress
Products
Cozystay Wordpress
CVE-2025-67987

WordPress Quiz And Survey Master plugin <= 10.3.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Expresstech Wordpress
Products
Quiz And Survey Master Wordpress
CVE-2025-67980

WordPress Hara theme <= 1.2.17 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.17.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Thembay Wordpress
Products
Hara Wordpress
CVE-2025-67979

WordPress WPForms Google Sheet Connector plugin <= 4.0.1 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Westerndeal Wordpress
Products
Wpforms Google Sheet Connector Wordpress
CVE-2025-67978

WordPress Educare plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FixBD Educare educare allows Reflected XSS.This issue affects Educare: from n/a through <= 1.6.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Fixbd Wordpress
Products
Educare Wordpress
CVE-2025-67968

WordPress Real Homes CRM plugin <= 1.0.0 - Arbitrary File Upload vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in InspiryThemes Real Homes CRM realhomes-crm allows Using Malicious Files.This issue affects Real Homes CRM: from n/a through <= 1.0.0.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Inspirythemes Wordpress
Products
Realhomes Wordpress
CVE-2025-67967

WordPress Lawyer Directory plugin <= 1.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Lawyer Directory Wordpress
CVE-2025-67966

WordPress Lawyer Directory plugin <= 1.3.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in e-plugins Lawyer Directory lawyer-directory allows Privilege Escalation.This issue affects Lawyer Directory: from n/a through <= 1.3.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
E-plugins Wordpress
Products
Lawyer Directory Wordpress
CVE-2025-67964

WordPress Homey Core plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey Core homey-core allows Reflected XSS.This issue affects Homey Core: from n/a through <= 2.4.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Favethemes Wordpress
Products
Homey Wordpress