Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2025-68018

WordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Ilmosys Woocommerce Wordpress
Products
Order Listener For Woocommerce Woocommerce Wordpress
CVE-2025-68019

WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cleverplugins Wordpress
Products
Seo Booster Wordpress
CVE-2025-66163

WordPress Masker for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masker for Elementor: from n/a through <= 1.1.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Merkulove Wordpress
Products
Masker For Elementor Wordpress
CVE-2025-66161

WordPress Grider for Elementor plugin <= 1.0.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Merkulove Wordpress
Products
Grider For Elementor Wordpress
CVE-2025-69319

WordPress Beaver Builder plugin <= 2.9.4.1 - Arbitrary Code Execution vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This issue affects Beaver Builder: from n/a through <= 2.9.4.1.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpbeaverbuilder
Products
Wordpress Beaver Builder
CVE-2025-68027

WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Themefic Wordpress
Products
Hydra Booking Wordpress
CVE-2025-69318

WordPress JobWP plugin <= 2.4.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue affects JobWP: from n/a through <= 2.4.5.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-69310

WordPress Woodly Core plugin <= 1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Woodly Core woodly-core allows Blind SQL Injection.This issue affects Woodly Core: from n/a through <= 1.4.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Teconcetheme Wordpress
Products
Woodly Core Wordpress
CVE-2025-69309

WordPress Saasplate Core plugin <= 1.2.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Saasplate Core saasplate-core allows Blind SQL Injection.This issue affects Saasplate Core: from n/a through <= 1.2.8.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Teconcetheme Wordpress
Products
Saasplate Core Wordpress
CVE-2025-66140

WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Merkulove Wordpress
Products
Uper For Elementor Wordpress
CVE-2025-69308

WordPress Nestbyte Core plugin <= 1.2 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Nestbyte Core nestbyte-core allows Blind SQL Injection.This issue affects Nestbyte Core: from n/a through <= 1.2.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Teconcetheme Wordpress
Products
Nestbyte Core Wordpress
CVE-2025-66129

WordPress Pochipp plugin <= 1.18.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through <= 1.18.0.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-69307

WordPress Medinik Core plugin <= 1.3.6 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Medinik Core medinik-core allows Blind SQL Injection.This issue affects Medinik Core: from n/a through <= 1.3.6.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Teconcetheme Wordpress
Products
Medinik Core Wordpress
CVE-2025-69306

WordPress Electio Core plugin <= 1.4 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Electio Core electio-core allows Blind SQL Injection.This issue affects Electio Core: from n/a through <= 1.4.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Teconcetheme Wordpress
Products
Electio Core Wordpress
CVE-2025-69305

WordPress Crete Core plugin <= 1.4.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TeconceTheme Crete Core crete-core allows Blind SQL Injection.This issue affects Crete Core: from n/a through <= 1.4.3.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Teconcetheme Wordpress
Products
Crete Core Wordpress
CVE-2025-66119

WordPress Hostel plugin <= 1.1.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects Hostel: from n/a through <= 1.1.5.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-66118

WordPress Sprout Clients plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected XSS.This issue affects Sprout Clients: from n/a through <= 3.2.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-68030

WordPress Frontis Blocks plugin <= 1.1.5 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in WP Messiah Frontis Blocks frontis-blocks allows Server Side Request Forgery.This issue affects Frontis Blocks: from n/a through <= 1.1.5.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-69299

WordPress Oxygen theme <= 6.0.8 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery (SSRF) vulnerability in Laborator Oxygen oxygen allows Server Side Request Forgery.This issue affects Oxygen: from n/a through <= 6.0.8.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Laborator Wordpress
Products
Oxygen Wordpress
CVE-2025-69297

WordPress Aardvark Plugin plugin <= 2.19 - Broken Access Control vulnerability

Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Aardvark Plugin: from n/a through <= 2.19.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ghostpool Wordpress
Products
Aardvark Plugin Wordpress