VYPR

CVEs

411,402 total · page 2209 of 8,229

AllCriticalHighKEV
  • CVE-2025-60127MedSep 26, 2025
    Artistscope
    Copysafe Web Protection
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CopySafe Web Protection: from n/a through <= 5.1.

  • CVE-2025-60126HigSep 26, 2025
    WordPress
    Testimonial Slider
    risk 0.57cvss 8.8epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through <= 3.5.8.6.

  • CVE-2025-60125MedSep 26, 2025
    WordPress
    FoodBook
    risk 0.34cvss 5.3epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects FoodBook: from n/a through <= 4.7.6.

  • CVE-2025-60124MedSep 26, 2025
    WordPress
    Simple Colorbox
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Stored XSS.This issue affects Simple Colorbox: from n/a through <= 1.6.1.

  • CVE-2025-60123MedSep 26, 2025
    WordPress
    Hivepress Claim Listings
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.

  • CVE-2025-60122MedSep 26, 2025
    WordPress
    Hivepress Claim Listings
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.

  • CVE-2025-60121MedSep 26, 2025
    WordPress
    WooEvents
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.

  • CVE-2025-60120MedSep 26, 2025
    WordPress
    Wp Directory Kit
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.

  • CVE-2025-60119MedSep 26, 2025
    Coschedule
    coschedule-by-todaymade
    risk 0.34cvss 5.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.

  • CVE-2025-60118HigSep 26, 2025
    Potenzaglobalsolutions
    PGS Core
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core pgs-core allows SQL Injection.This issue affects PGS Core: from n/a through <= 5.9.0.

  • CVE-2025-60117MedSep 26, 2025
    WordPress
    Vehica Core
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.

  • CVE-2025-60116MedSep 26, 2025
    Themegoods
    Grand Conference
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.

  • CVE-2025-60115MedSep 26, 2025
    WordPress
    Instapage Plugin
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.This issue affects Instapage Plugin: from n/a through <= 3.7.0.

  • CVE-2025-60114MedSep 26, 2025
    WordPress
    Yaycurrency
    risk 0.43cvss 6.6epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.

  • CVE-2025-60113MedSep 26, 2025
    WordPress
    Groovy Menu
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through <= 1.4.3.

  • CVE-2025-60112MedSep 26, 2025
    WordPress
    Athemes Addons For Elementor Lite
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.

  • CVE-2025-60111HigSep 26, 2025
    WordPress
    Javo Core
    risk 0.57cvss 8.8epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through <= 3.0.0.266.

  • CVE-2025-60110HigSep 26, 2025
    WordPress
    All In One Banner Rotator
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows SQL Injection.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.

  • CVE-2025-60109HigSep 26, 2025
    WordPress
    All In One Content Slider
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Content Slider: from n/a…

  • CVE-2025-60108HigSep 26, 2025
    LambertGroup
    AllInOne - Banner with Thumbnails
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with…

  • CVE-2025-60107HigSep 26, 2025
    LambertGroup
    All-in-One - Banner with Playlist
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with…

  • CVE-2025-60106MedSep 26, 2025
    Roxnor
    EmailKit
    risk 0.32cvss 4.9epss 0.00

    Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmailKit: from n/a through <= 1.6.0.

  • CVE-2025-60105MedSep 26, 2025
    WordPress
    Ditty News Ticker
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.

  • CVE-2025-60104MedSep 26, 2025
    WordPress
    Gallery Custom Links
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.

  • CVE-2025-60103MedSep 26, 2025
    WordPress
    Listingpro
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.8.

  • CVE-2025-60102MedSep 26, 2025
    WordPress
    Wpfront User Role Editor
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.

  • CVE-2025-60101MedSep 26, 2025
    WordPress
    Woostify
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through <= 2.4.2.

  • CVE-2025-60100MedSep 26, 2025
    WordPress
    Xstore
    risk 0.34cvss 5.3epss 0.00

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

  • CVE-2025-60099MedSep 26, 2025
    WordPress
    Embed Any Document
    risk 0.35cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Embed Any Document embed-any-document allows Stored XSS.This issue affects Embed Any Document: from n/a through <= 2.7.7.

  • CVE-2025-60098MedSep 26, 2025
    WordPress
    Theme My Login
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theme My Login: from n/a through <= 7.1.12.

  • CVE-2025-60097MedSep 26, 2025
    WordPress
    Thegem
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.

  • CVE-2025-60096MedSep 26, 2025
    CodexThemes
    TheGem (Elementor)
    risk 0.35cvss 5.4epss 0.00

    Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.

  • CVE-2025-60095MedSep 26, 2025
    WordPress
    Stackable Ultimate Gutenberg Blocks
    risk 0.28cvss 4.3epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Retrieve Embedded Sensitive Data.This issue affects Stackable: from n/a through <= 3.18.1.

  • CVE-2025-60094MedSep 26, 2025
    WordPress
    Stackable Ultimate Gutenberg Blocks
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.

  • CVE-2025-60093MedSep 26, 2025
    WordPress
    Download Manager
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through <= 3.3.24.

  • CVE-2025-60092MedSep 26, 2025
    WordPress
    Download Manager
    risk 0.34cvss 5.3epss 0.00

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25.

  • CVE-2025-60040MedSep 26, 2025
    WordPress
    Wp Mpdf
    risk 0.35cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fkrauthan wp-mpdf wp-mpdf allows Stored XSS.This issue affects wp-mpdf: from n/a through <= 3.9.1.

  • CVE-2025-59012HigSep 26, 2025
    WordPress
    Traveler
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shinetheme Traveler traveler allows Reflected XSS.This issue affects Traveler: from n/a through < 3.2.3.

  • CVE-2025-59011HigSep 26, 2025
    WordPress
    Traveler
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through < 3.2.3.

  • CVE-2025-59010HigSep 26, 2025
    WordPress
    Permalink Manager Lite
    risk 0.49cvss 7.5epss 0.00

    Insertion of Sensitive Information Into Sent Data vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Retrieve Embedded Sensitive Data.This issue affects Permalink Manager Lite: from n/a through <= 2.5.1.3.

  • CVE-2025-59002HigSep 26, 2025
    WordPress
    Bm Content Builder
    risk 0.50cvss 7.7epss 0.00

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.

  • CVE-2025-58919MedSep 26, 2025
    WordPress
    Wide Banner
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in guihom Wide Banner wide-banner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wide Banner: from n/a through <= 1.0.4.

  • CVE-2025-58917MedSep 26, 2025
    WordPress
    Quantities And Units For Woocommerce
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Verwymeren Quantities and Units for WooCommerce quantities-and-units-for-woocommerce allows Stored XSS.This issue affects Quantities and Units for WooCommerce: from n/a…

  • CVE-2025-58914MedSep 26, 2025
    WordPress
    Di Themes Demo Site Importer
    risk 0.28cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Di Themes Di Themes Demo Site Importer di-themes-demo-site-importer allows Cross Site Request Forgery.This issue affects Di Themes Demo Site Importer: from n/a through <= 1.2.

  • CVE-2025-4957HigSep 26, 2025
    Metagauss
    Profilegrid
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Reflected XSS.This issue affects ProfileGrid : from n/a through <= 5.9.5.7.

  • CVE-2025-48326MedSep 26, 2025
    WordPress
    Acclectic Media Organizer
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Acclectic Media Acclectic Media Organizer acclectic-media-organizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acclectic Media Organizer: from n/a through <= 1.4.

  • CVE-2025-48107HigSep 26, 2025
    WordPress
    Uncode
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in undsgn Uncode uncode allows Reflected XSS.This issue affects Uncode: from n/a through < 2.9.4.4.

  • CVE-2025-27006MedSep 26, 2025
    WordPress
    Authorsy
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeplugs Authorsy authorsy allows Stored XSS.This issue affects Authorsy: from n/a through <= 1.0.5.

  • CVE-2025-1862MedSep 26, 2025
    risk 0.44cvss 6.7epss 0.01

    An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on…

  • CVE-2025-11021HigSep 26, 2025
    GNOME Foundation
    Libsoup
    risk 0.49cvss 7.5epss 0.01

    A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory read. This flaw…