Export limit exceeded: 10244 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Export limit exceeded: 16394 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16,394

Export CSV
CVE-2025-68072

WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability

Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Merv Barrett Wordpress
Products
Easy Property Listings Wordpress
CVE-2025-68050

WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Leadpages Wordpress
Products
Leadpages Wordpress
CVE-2025-68048

WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Xlplugins
Products
Wordpress Nextmove
CVE-2025-68047

WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Arraytics Wordpress
Products
Eventin Wordpress
CVE-2025-68046

WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Themehunk Wordpress
Products
Contact Form & Lead Form Elementor Builder Wordpress
CVE-2025-68037

WordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Atlasgondal Wordpress
Products
Export Media Urls Wordpress
CVE-2025-68035

WordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-68026

WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability

Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Niaj Morshed Wordpress
Products
Lc Wizard Wordpress
CVE-2025-68024

WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability

Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Addonify Wordpress
Products
Addonify – Woocommerce Wishlist Wordpress
CVE-2025-68019

WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cleverplugins Wordpress
Products
Seo Booster Wordpress
CVE-2025-68018

WordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed
Vendors
Ilmosys Woocommerce Wordpress
Products
Order Listener For Woocommerce Woocommerce Wordpress
CVE-2025-68015

WordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Vollstart Wordpress
Products
Event Tickets With Ticket Scanner Wordpress
CVE-2025-68008

WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Mndpsingh287 Wordpress
Products
Wp Mail Wordpress
CVE-2025-68006

WordPress Booking Ultra Pro plugin <= 1.1.23 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-68004

WordPress My Post Order plugin <= 1.2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affects My Post Order: from n/a through <= 1.2.1.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress
Products
Wordpress
CVE-2025-67998

WordPress Miraculous Elementor plugin <= 2.0.7 - Broken Authentication vulnerability

Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Kamleshyadav Wordpress
Products
Miraculous Elementor Wordpress
CVE-2025-67997

WordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Boldthemes Wordpress
Products
Travelicious Wordpress
CVE-2025-67996

WordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Boldthemes Wordpress
Products
Nestin Wordpress
CVE-2025-67995

WordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Loftocean Wordpress
Products
Patiotime Wordpress
CVE-2025-67993

WordPress Atarim plugin <= 4.2.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Vito Peleg Wordpress
Products
Atarim Wordpress