VYPR

CVEs

410,290 total · page 1974 of 8,206

AllCriticalHighKEV
  • CVE-2025-0836MedDec 16, 2025
    Milestone Systems
    XProtect VMS
    risk 0.41cvss 6.3epss 0.00

    Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to MIP Webhooks API.

  • CVE-2025-14002HigDec 16, 2025
    WordPress
    Wpcom Member
    risk 0.46cvss 8.1epss 0.01

    The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak OTP (One-Time Password) generation using only 6 numeric digits combined with a 10-minute validity window and no rate…

  • CVE-2025-68088MedDec 16, 2025
    WordPress
    Huger Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Huger for Elementor huger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Huger for Elementor: from n/a through <= 1.1.5.

  • CVE-2025-68087MedDec 16, 2025
    WordPress
    Modalier Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Modalier for Elementor modalier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modalier for Elementor: from n/a through <= 1.0.6.

  • CVE-2025-68086MedDec 16, 2025
    WordPress
    Reformer Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reformer for Elementor: from n/a through <= 1.0.6.

  • CVE-2025-68085MedDec 16, 2025
    WordPress
    Buttoner for Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Buttoner for Elementor: from n/a through <= 1.0.6.

  • CVE-2025-68084MedDec 16, 2025
    WordPress
    Ultimate Auction
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Auction : from n/a through <= 4.3.3.

  • CVE-2025-68083MedDec 16, 2025
    WordPress
    Meks Quick Plugin Disabler
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affects Meks Quick Plugin Disabler: from n/a through <= 1.0.

  • CVE-2025-68082MedDec 16, 2025
    SEMrush CY LTD
    Semrush Content Toolkit
    risk 0.35cvss 5.4epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through <= 1.1.32.

  • CVE-2025-68080MedDec 16, 2025
    WordPress
    User Avatar Reloaded
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal User Avatar - Reloaded user-avatar-reloaded allows Stored XSS.This issue affects User Avatar - Reloaded: from n/a through <= 1.2.2.

  • CVE-2025-68079MedDec 16, 2025
    WordPress
    Salient Shortcodes
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Shortcodes salient-shortcodes allows Stored XSS.This issue affects Salient Shortcodes: from n/a through <= 1.5.4.

  • CVE-2025-68078MedDec 16, 2025
    WordPress
    Salient Portfolio
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows Stored XSS.This issue affects Salient Portfolio: from n/a through <= 1.8.2.

  • CVE-2025-68077MedDec 16, 2025
    WordPress
    Stockholm
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm stockholm allows Stored XSS.This issue affects Stockholm: from n/a through <= 9.14.1.

  • CVE-2025-68076MedDec 16, 2025
    WordPress
    Stockholm Core
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored XSS.This issue affects Stockholm Core: from n/a through <= 2.4.6.

  • CVE-2025-68071MedDec 16, 2025
    WordPress
    Essential Real Estate
    risk 0.42cvss 6.5epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

  • CVE-2025-68070MedDec 16, 2025
    Vektor,Inc.
    VK Google Job Posting Manager
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Stored XSS.This issue affects VK Google Job Posting Manager: from n/a through <= 1.2.22.

  • CVE-2025-68068HigDec 16, 2025
    WordPress
    Stockholm
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through <= 9.14.1.

  • CVE-2025-68067HigDec 16, 2025
    WordPress
    Stockholm Core
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm-core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through <= 2.4.6.

  • CVE-2025-68066HigDec 16, 2025
    WordPress
    Soledad
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects Soledad: from n/a through <= 8.7.0.

  • CVE-2025-68065HigDec 16, 2025
    WordPress
    Hub Core
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local File Inclusion. This issue affects Hub Core: from n/a before 6.0.2.

  • CVE-2025-68062HigDec 16, 2025
    Thememove
    Minimogwp
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

  • CVE-2025-68061HigDec 16, 2025
    Thememove
    Edumall
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through <= 4.4.7.

  • CVE-2025-68056HigDec 16, 2025
    WordPress
    lbg_zoominoutslider
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allows SQL Injection.This issue affects LBG Zoominoutslider: from n/a through <= 5.4.4.

  • CVE-2025-68055HigDec 16, 2025
    WordPress
    Hydra Booking
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.

  • CVE-2025-68054HigDec 16, 2025
    LambertGroup
    CountDown With Image or Video Background
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown With Image or Video Background countdown_with_background allows Blind SQL Injection.This issue affects CountDown With Image or Video Background: from n/a…

  • CVE-2025-68053HigDec 16, 2025
    LambertGroup
    xPromoter
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup xPromoter top_bar_promoter allows Blind SQL Injection.This issue affects xPromoter: from n/a through <= 1.3.4.

  • CVE-2025-67999HigDec 16, 2025
    WordPress
    Newsletter
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Injection.This issue affects Newsletter: from n/a through <= 9.0.9.

  • CVE-2025-67989MedDec 16, 2025
    WordPress
    Kerge
    risk 0.35cvss 5.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through <= 4.1.3.

  • CVE-2025-67986MedDec 16, 2025
    WordPress
    Document Library Lite
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows DOM-Based XSS.This issue affects Document Library Lite: from n/a through <= 1.1.7.

  • CVE-2025-67985MedDec 16, 2025
    WordPress
    Document Library Lite
    risk 0.34cvss 5.3epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Document Library Lite: from n/a through <= 1.1.7.

  • CVE-2025-67983MedDec 16, 2025
    WordPress
    Visitors Traffic Real Time Statistics
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows DOM-Based XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from n/a through <= 8.3.

  • CVE-2025-67976MedDec 16, 2025
    WordPress
    Watu Quiz
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.

  • CVE-2025-67965MedDec 16, 2025
    WordPress
    Homey Core
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

  • CVE-2025-67962HigDec 16, 2025
    WordPress
    Broken Link Checker
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AIOSEO Plugin Team Broken Link Checker broken-link-checker-seo allows SQL Injection.This issue affects Broken Link Checker: from n/a through <= 1.2.6.

  • CVE-2025-67951MedDec 16, 2025
    WordPress
    Wpzoom Addons For Elementor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor wpzoom-elementor-addons allows DOM-Based XSS.This issue affects WPZOOM Addons for Elementor: from n/a through <= 1.2.10.

  • CVE-2025-67950HigDec 16, 2025
    WordPress
    All In One Seo Pack
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allows Blind SQL Injection.This issue affects All In One SEO Pack: from n/a through <= 4.9.1.

  • CVE-2025-67948MedDec 16, 2025
    WordPress
    Sendpulse Email Marketing Newsletter
    risk 0.28cvss 4.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketing Newsletter: from…

  • CVE-2025-67929MedDec 16, 2025
    WordPress
    Ti Woocommerce Wishlist
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

  • CVE-2025-67912MedDec 16, 2025
    WordPress
    Stars Testimonials
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-and-masonry-grid allows Stored XSS.This issue affects Stars Testimonials: from n/a through <= 3.3.4.

  • CVE-2025-66167MedDec 16, 2025
    WordPress
    Lottier Gutenberg
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Lottier lottier-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier: from n/a through <= 1.1.1.

  • CVE-2025-66166MedDec 16, 2025
    WordPress
    Lottier Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Lottier for Elementor lottier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for Elementor: from n/a through <= 1.0.9.

  • CVE-2025-66165MedDec 16, 2025
    WordPress
    Lottier Wpbakery
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for WPBakery: from n/a through <= 1.1.7.

  • CVE-2025-66164MedDec 16, 2025
    WordPress
    Laser
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser: from n/a through <= 1.1.1.

  • CVE-2025-66163MedDec 16, 2025
    WordPress
    Masker Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masker for Elementor: from n/a through <= 1.1.4.

  • CVE-2025-66162MedDec 16, 2025
    WordPress
    Spoter for Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spoter for Elementor: from n/a through <= 1.04.

  • CVE-2025-66161MedDec 16, 2025
    WordPress
    Grider for Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.

  • CVE-2025-66147MedDec 16, 2025
    WordPress
    Coder for Elementor
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coder for Elementor: from n/a through <= 1.0.13.

  • CVE-2025-66134MedDec 16, 2025
    WordPress
    Filebird
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FileBird Pro: from n/a through <= 6.5.1.

  • CVE-2025-66133MedDec 16, 2025
    WordPress
    WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a…

  • CVE-2025-66132MedDec 16, 2025
    FAPI Business s.r.o.
    FAPI Member
    risk 0.34cvss 5.3epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in FAPI Business s.r.o. FAPI Member fapi-member allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAPI Member: from n/a through <= 2.2.30.