VYPR

CVEs

408,309 total · page 1713 of 8,167

AllCriticalHighKEV
  • CVE-2025-68000MedFeb 20, 2026
    Pickplugins
    Testimonial Slider
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.

  • CVE-2025-67998HigFeb 20, 2026
    WordPress
    Miraculous Elementor
    risk 0.57cvss 8.8epss 0.00

    Authentication Bypass Using an Alternate Path or Channel vulnerability in kamleshyadav Miraculous Elementor miraculous-el allows Authentication Abuse.This issue affects Miraculous Elementor: from n/a through <= 2.0.7.

  • CVE-2025-67997CriFeb 20, 2026
    WordPress
    Travelicious
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldThemes Travelicious travelicious allows Object Injection.This issue affects Travelicious: from n/a through < 1.6.7.

  • CVE-2025-67996CriFeb 20, 2026
    WordPress
    Nestin
    risk 0.64cvss 9.8epss 0.00

    Deserialization of Untrusted Data vulnerability in BoldThemes Nestin nestin allows Object Injection.This issue affects Nestin: from n/a through < 1.2.6.

  • CVE-2025-67995CriFeb 20, 2026
    WordPress
    PatioTime
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in LoftOcean PatioTime patiotime allows Object Injection.This issue affects PatioTime: from n/a through < 2.1.

  • CVE-2025-67994HigFeb 20, 2026
    WordPress
    Yaycurrency
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayCurrency: from n/a through <= 3.3.

  • CVE-2025-67993MedFeb 20, 2026
    WordPress
    Atarim Visual Collaboration
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Atarim: from n/a through <= 4.2.1.

  • CVE-2025-67992HigFeb 20, 2026
    LoftOcean
    PatioTime
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean PatioTime patiotime allows PHP Local File Inclusion.This issue affects PatioTime: from n/a through < 2.1.

  • CVE-2025-67991HigFeb 20, 2026
    WordPress
    Wp User Extra Fields
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Reflected XSS.This issue affects User Extra Fields: from n/a through <= 16.8.

  • CVE-2025-67990HigFeb 20, 2026
    Realmag777
    GMap Targeting
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 GMap Targeting gmap-targeting allows Reflected XSS.This issue affects GMap Targeting: from n/a through <= 1.1.7.

  • CVE-2025-67988HigFeb 20, 2026
    LoftOcean
    CozyStay
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean CozyStay cozystay allows PHP Local File Inclusion.This issue affects CozyStay: from n/a through < 1.9.1.

  • CVE-2025-67987HigFeb 20, 2026
    ExpressTech Systems
    Quiz And Survey Master
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.3.1.

  • CVE-2025-67984HigFeb 20, 2026
    WordPress
    Nps Computy
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in calliko NPS computy nps-computy allows DOM-Based XSS.This issue affects NPS computy: from n/a through <= 2.8.2.

  • CVE-2025-67982HigFeb 20, 2026
    WordPress
    Urna
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Urna urna allows PHP Local File Inclusion.This issue affects Urna: from n/a through <= 2.5.12.

  • CVE-2025-67981HigFeb 20, 2026
    WordPress
    Besa
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Besa besa allows PHP Local File Inclusion.This issue affects Besa: from n/a through <= 2.3.15.

  • CVE-2025-67980HigFeb 20, 2026
    WordPress
    Hara
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Hara hara allows PHP Local File Inclusion.This issue affects Hara: from n/a through <= 1.2.17.

  • CVE-2025-67979CriFeb 20, 2026
    WordPress
    WPForms Google Sheet Connector
    risk 0.64cvss 9.9epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Code Injection.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.1.

  • CVE-2025-67978HigFeb 20, 2026
    WordPress
    Educare
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FixBD Educare educare allows Reflected XSS.This issue affects Educare: from n/a through <= 1.6.1.

  • CVE-2025-67977HigFeb 20, 2026
    WordPress
    Happy Helpdesk Support Ticket System
    risk 0.53cvss 8.2epss 0.00

    Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HAPPY: from n/a through <= 1.0.8.

  • CVE-2025-67975MedFeb 20, 2026
    WordPress
    Adirectory
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects aDirectory: from n/a through <= 3.0.3.

  • CVE-2025-67974HigFeb 20, 2026
    WordPress
    Wplegalpages
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPLegalPages: from n/a through <= 3.5.4.

  • CVE-2025-67973MedFeb 20, 2026
    WordPress
    Sunshine Photo Cart
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.6.2.

  • CVE-2025-67972MedFeb 20, 2026
    Zoho
    Zoho ZeptoMail
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.

  • CVE-2025-67971HigFeb 20, 2026
    WordPress
    FluentCart
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja FluentCart fluent-cart allows Reflected XSS.This issue affects FluentCart: from n/a through < 1.3.0.

  • CVE-2025-67970MedFeb 20, 2026
    WordPress
    Schedula
    risk 0.38cvss 5.9epss 0.00

    Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0.

  • CVE-2025-67969MedFeb 20, 2026
    WordPress
    UPI QR Code Payment Gateway for WooCommerce
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through…

  • CVE-2025-67624MedFeb 20, 2026
    WordPress
    Optimize More! – Images
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! – Images: from n/a through <= 1.1.3.

  • CVE-2025-67547MedFeb 20, 2026
    WordPress
    Konte
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.

  • CVE-2025-67438MedFeb 20, 2026
    Sync In
    Server
    risk 0.33cvss 6.1epss 0.00

    A Stored Cross-Site Scripting (XSS) vulnerability in Sync-in Server before 1.9.3 allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser. By uploading a crafted SVG file containing a malicious payload, an attacker can access and exfiltrate…

  • CVE-2025-60183MedFeb 20, 2026
    Silencesoft
    RSS Reader
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in silence Silencesoft RSS Reader external-rss-reader allows Stored XSS.This issue affects Silencesoft RSS Reader: from n/a through <= 0.6.

  • CVE-2025-60087HigFeb 20, 2026
    WordPress
    Extensive VC Addons for WPBakery page builder
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nenad Obradovic Extensive VC Addons for WPBakery page builder extensive-vc-addon allows PHP Local File Inclusion.This issue affects Extensive VC Addons for…

  • CVE-2025-53237HigFeb 20, 2026
    WordPress
    WP Wizard Cloak
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soflyy WP Wizard Cloak wp-wizard-cloak allows Reflected XSS.This issue affects WP Wizard Cloak: from n/a through <= 1.0.1.

  • CVE-2025-53233HigFeb 20, 2026
    WordPress
    Storyform
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RylanH Storyform storyform allows Reflected XSS.This issue affects Storyform: from n/a through <= 0.6.14.

  • CVE-2025-53231HigFeb 20, 2026
    WordPress
    Easy Taxonomy Images
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevstudio Easy Taxonomy Images easy-taxonomy-images allows Stored XSS.This issue affects Easy Taxonomy Images: from n/a through <= 1.0.1.

  • CVE-2025-53228HigFeb 20, 2026
    WordPress
    Bbpress Simple Advert Units
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jezza101 bbpress Simple Advert Units bbpress-simple-advert-units allows Reflected XSS.This issue affects bbpress Simple Advert Units: from n/a through <= 0.41.

  • CVE-2025-53217HigFeb 20, 2026
    WordPress
    AIO WP Builder
    risk 0.49cvss 7.6epss 0.00

    Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2.

  • CVE-2025-52744HigFeb 20, 2026
    WordPress
    Inpersttion For Theme
    risk 0.50cvss 7.7epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through <= 1.0.

  • CVE-2025-52603LowFeb 20, 2026
    HCLTech
    Connections
    risk 0.23cvss 3.5epss 0.00

    HCL Connections is vulnerable to information disclosure. In a very specific user navigation scenario, this could allow a user to obtain limited information when a single piece of internal metadata is returned in the browser.

  • CVE-2024-56208MedFeb 20, 2026
    WordPress
    Newsmash
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in desertthemes NewsMash newsmash allows Stored XSS.This issue affects NewsMash: from n/a through <= 1.0.71.

  • CVE-2024-54222MedFeb 20, 2026
    Seraphinite Solutions
    Seraphinite Accelerator
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.

  • CVE-2024-52387MedFeb 20, 2026
    WordPress
    Master Addons For Elementor
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Stored XSS.This issue affects Master Addons for Elementor: from n/a through <= 2.0.9.9.4.

  • CVE-2024-51915MedFeb 20, 2026
    Litespeedtech
    LiteSpeed Cache
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.2.

  • CVE-2024-50555MedFeb 20, 2026
    WordPress
    Elementor Website Builder
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.29.0.

  • CVE-2024-50452MedFeb 20, 2026
    WordPress
    Nexter Blocks
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Stored XSS.This issue affects Nexter Blocks: from n/a through <= 3.3.3.

  • CVE-2024-43228MedFeb 20, 2026
    WordPress
    SecuPress Free
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.

  • CVE-2024-34438MedFeb 20, 2026
    WordPress
    Shared Files
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.

  • CVE-2026-21627CriFeb 20, 2026
    Tassos
    Tassos Framework
    risk 0.62cvss —epss 0.02

    The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

  • CVE-2025-14547LowFeb 20, 2026
    Silabs.com
    PSA Crypto and SE Manager EC-JPAKE APIs
    risk 0.15cvss —epss 0.00

    An integer underflow vulnerability is present in Silicon Lab’s implementation of PSA Crypto and SE Manager EC-JPAKE APIs during ZKP parsing. Triggering the underflow can lead to a hard fault, causing a temporary denial of service.

  • CVE-2025-14055LowFeb 20, 2026
    Silabs.com
    Secure NCP host implementation
    risk 0.16cvss —epss 0.00

    An integer underflow vulnerability in Silicon Labs Secure NCP host implementation allows a buffer overread via a specially crafted packet.

  • CVE-2026-2486MedFeb 20, 2026
    WordPress
    Master Addons For Elementor
    risk 0.35cvss 6.4epss 0.00

    The Master Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ma_el_bh_table_btn_text' parameter in versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for…