VYPR

CVEs

408,430 total · page 1814 of 8,169

AllCriticalHighKEV
  • CVE-2025-67617CriJan 22, 2026
    WordPress
    Consult Aid
    risk 0.64cvss 9.8epss 0.01

    Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

  • CVE-2025-67616HigJan 22, 2026
    WordPress
    Mella
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BZOTheme Mella mella allows PHP Local File Inclusion.This issue affects Mella: from n/a through <= 1.2.29.

  • CVE-2025-67615HigJan 22, 2026
    WordPress
    Myour
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bslthemes Myour myour allows PHP Local File Inclusion.This issue affects Myour: from n/a through <= 1.5.1.

  • CVE-2025-67614HigJan 22, 2026
    WordPress
    TheNa
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in foreverpinetree TheNa thena allows Reflected XSS.This issue affects TheNa: from n/a through <= 1.5.5.

  • CVE-2025-67221HigJan 22, 2026
    Ijl
    Orjson
    risk 0.42cvss 7.5epss 0.01

    The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.

  • CVE-2025-66143MedJan 22, 2026
    WordPress
    Crumber Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10.

  • CVE-2025-66142MedJan 22, 2026
    WordPress
    Comparimager Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.

  • CVE-2025-66141MedJan 22, 2026
    WordPress
    Scroller
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2.

  • CVE-2025-66140MedJan 22, 2026
    WordPress
    Uper Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.

  • CVE-2025-66139MedJan 22, 2026
    WordPress
    Audier Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.

  • CVE-2025-66138MedJan 22, 2026
    WordPress
    Motionger for Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.

  • CVE-2025-66137MedJan 22, 2026
    WordPress
    Searcher Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.

  • CVE-2025-66136MedJan 22, 2026
    WordPress
    Carter Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.

  • CVE-2025-66135MedJan 22, 2026
    WordPress
    Imager Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.

  • CVE-2025-64252MedJan 22, 2026
    Marco Milesi
    Anac XML Viewer
    risk 0.32cvss 4.9epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in Marco Milesi ANAC XML Viewer anac-xml-viewer allows Server Side Request Forgery.This issue affects ANAC XML Viewer: from n/a through <= 1.8.2.

  • CVE-2025-63051MedJan 22, 2026
    WordPress
    Rehub Framework
    risk 0.28cvss 4.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4.

  • CVE-2025-63026MedJan 22, 2026
    WordPress
    Grand Restaurant Theme Elements for Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for Elementor: from n/a…

  • CVE-2025-63019MedJan 22, 2026
    WordPress
    Cookies And Content Security Policy
    risk 0.34cvss 5.3epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content Security Policy: from n/a through <=…

  • CVE-2025-63018MedJan 22, 2026
    WordPress
    Bard
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in wproyal Bard bard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bard: from n/a through <= 2.229.

  • CVE-2025-63017HigJan 22, 2026
    WordPress
    Werkstatt Plugin
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes WerkStatt Plugin werkstatt-plugin allows PHP Local File Inclusion.This issue affects WerkStatt Plugin: from n/a through <= 1.6.6.

  • CVE-2025-62754MedJan 22, 2026
    WordPress
    Payment Gateway bKash for WC
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.

  • CVE-2025-62741MedJan 22, 2026
    Smartdatasoft
    Pool Services
    risk 0.35cvss 5.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Pool Services pool-services allows Server Side Request Forgery.This issue affects Pool Services: from n/a through <= 3.3.

  • CVE-2025-62106MedJan 22, 2026
    WordPress
    Wp CRM System
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5.

  • CVE-2025-62077MedJan 22, 2026
    SEOSEON EUROPE S.L
    Affiliate Link Tracker
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SEOSEON EUROPE S.L Affiliate Link Tracker affiliate-link-tracker allows Stored XSS.This issue affects Affiliate Link Tracker: from n/a through <= 0.2.

  • CVE-2025-62056CriJan 22, 2026
    WordPress
    News Event
    risk 0.64cvss 9.9epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes News Event news-event.This issue affects News Event: from n/a through <= 1.0.1.

  • CVE-2025-62050CriJan 22, 2026
    WordPress
    Blogmatic
    risk 0.64cvss 9.9epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogmatic blogmatic.This issue affects Blogmatic: from n/a through <= 1.0.3.

  • CVE-2025-5805MedJan 22, 2026
    WordPress
    Electron
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Ninetheme Electron electron allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electron: from n/a through <= 1.8.2.

  • CVE-2025-56589HigJan 22, 2026
    Apryse
    Html2pdf
    risk 0.49cvss 7.5epss 0.00

    A Local File Inclusion (LFI) and a Server-Side Request Forgery (SSRF) vulnerability was found in the InsertFromHtmlString() function of the Apryse HTML2PDF SDK thru 11.6.0. These vulnerabilities could allow an attacker to read local files on the server or make arbitrary HTTP…

  • CVE-2025-54003HigJan 22, 2026
    WordPress
    Depot
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Depot depot allows PHP Local File Inclusion.This issue affects Depot: from n/a through <= 1.16.

  • CVE-2025-54002MedJan 22, 2026
    Jthemes
    xSmart
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart: from n/a through <= 1.2.9.4.

  • CVE-2025-53240HigJan 22, 2026
    WordPress
    Photogallery
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in adamlabs WordPress Photo Gallery photo-gallery-portfolio allows Reflected XSS.This issue affects WordPress Photo Gallery: from n/a through <= 1.1.0.

  • CVE-2025-52762HigJan 22, 2026
    WordPress
    Flexo Posts Manager
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio flexo-posts-manager flexo-posts-manager allows Reflected XSS.This issue affects flexo-posts-manager: from n/a through <= 1.0001.

  • CVE-2025-52746HigJan 22, 2026
    WordPress
    Restaurante
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ayecode Restaurante restaurante allows Reflected XSS.This issue affects Restaurante: from n/a through <= 3.0.7.

  • CVE-2025-50007HigJan 22, 2026
    WordPress
    xSmart
    risk 0.57cvss 8.8epss 0.01

    Incorrect Privilege Assignment vulnerability in Jthemes xSmart xsmart allows Privilege Escalation.This issue affects xSmart: from n/a through <= 1.2.9.4.

  • CVE-2025-50006HigJan 22, 2026
    WordPress
    xSmart
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes xSmart xsmart allows Reflected XSS.This issue affects xSmart: from n/a through <= 1.2.9.4.

  • CVE-2025-50005MedJan 22, 2026
    WordPress
    Tagdiv Composer
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer allows DOM-Based XSS.This issue affects tagDiv Composer: from n/a through <= 5.4.2.

  • CVE-2025-50004HigJan 22, 2026
    WordPress
    Jupiterx Core
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in artbees JupiterX Core jupiterx-core allows Object Injection.This issue affects JupiterX Core: from n/a through <= 4.10.1.

  • CVE-2025-50003HigJan 22, 2026
    WordPress
    Amuli
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Amuli amuli allows PHP Local File Inclusion.This issue affects Amuli: from n/a through <= 2.3.0.

  • CVE-2025-50002CriJan 22, 2026
    WordPress
    Energia
    risk 0.65cvss 10.0epss 0.01

    Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Upload a Web Shell to a Web Server.This issue affects Energia: from n/a through <= 1.1.2.

  • CVE-2025-49994HigJan 22, 2026
    WordPress
    Athens
    risk 0.53cvss 8.1epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme Athens athens allows PHP Local File Inclusion.This issue affects Athens: from n/a through <= 1.1.6.

  • CVE-2025-49375MedJan 22, 2026
    WordPress
    HomeLancer
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeLancer: from n/a through <= 1.0.1.

  • CVE-2025-49336MedJan 22, 2026
    WordPress
    Pondol Bbs
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pondol Pondol BBS pondol-bbs allows Stored XSS.This issue affects Pondol BBS: from n/a through <= 1.1.8.4.

  • CVE-2025-49249HigJan 22, 2026
    WordPress
    Drone
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Drone drone allows Reflected XSS.This issue affects Drone: from n/a through <= 1.40.

  • CVE-2025-49066HigJan 22, 2026
    WordPress
    Accordion Slider Pro
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Accordion Slider PRO accordion_slider_pro allows Reflected XSS.This issue affects Accordion Slider PRO: from n/a through <= 1.2.

  • CVE-2025-49055CriJan 22, 2026
    WordPress
    WP Lead Capturing Pages
    risk 0.60cvss 9.3epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  • CVE-2025-49050HigJan 22, 2026
    WordPress
    WP Lead Capturing Pages
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in kamleshyadav WP Lead Capturing Pages wp-lead-capture allows Blind SQL Injection.This issue affects WP Lead Capturing Pages: from n/a through <= 2.5.

  • CVE-2025-49049HigJan 22, 2026
    WordPress
    Dzs Videogallery
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ZoomIt DZS Video Gallery dzs-videogallery allows SQL Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.

  • CVE-2025-49046HigJan 22, 2026
    LambertGroup
    xPromoter
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup xPromoter top_bar_promoter allows Reflected XSS.This issue affects xPromoter: from n/a through <= 1.3.4.

  • CVE-2025-49045HigJan 22, 2026
    highwarden
    Super Interactive Maps
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Interactive Maps super-interactive-maps allows Reflected XSS.This issue affects Super Interactive Maps: from n/a through <= 2.3.

  • CVE-2025-49043HigJan 22, 2026
    WordPress
    Magic Responsive Slider and Carousel
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Magic Responsive Slider and Carousel WordPress magic_carousel allows Reflected XSS.This issue affects Magic Responsive Slider and Carousel WordPress: from n/a…