VYPR

CVEs

31,889 total · page 231 of 638

AllCriticalHighKEV
  • CVE-2025-49992HigOct 22, 2025
    WordPress
    Learnpress Import Export
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress Export Import learnpress-import-export allows Reflected XSS.This issue affects LearnPress Export Import: from n/a through <= 4.0.9.

  • CVE-2025-49963HigOct 22, 2025
    WordPress
    Simple Stripe Checkout
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in growniche Simple Stripe Checkout simple-stripe-checkout allows Reflected XSS.This issue affects Simple Stripe Checkout: from n/a through <= 1.1.28.

  • CVE-2025-49962HigOct 22, 2025
    WordPress
    Bbpress Notify Nospam
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in useStrict bbPress Notify bbpress-notify-nospam allows Reflected XSS.This issue affects bbPress Notify: from n/a through <= 2.19.5.

  • CVE-2025-49959HigOct 22, 2025
    Pascal Casier
    bbPress Move Topics
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Casier bbPress Move Topics bbp-move-topics allows Reflected XSS.This issue affects bbPress Move Topics: from n/a through <= 1.1.6.

  • CVE-2025-49958HigOct 22, 2025
    robokassa
    Robokassa payment gateway for Woocommerce
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robokassa Robokassa payment gateway for Woocommerce robokassa allows Reflected XSS.This issue affects Robokassa payment gateway for Woocommerce: from n/a through <= 1.8.6.

  • CVE-2025-49957HigOct 22, 2025
    WordPress
    Email Attachment By Order Status Products
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Weboccult Technologies Pvt Ltd Email Attachment by Order Status & Products email-attachment-by-order-status-products allows Reflected XSS.This issue affects Email Attachment by…

  • CVE-2025-49956HigOct 22, 2025
    Anandaraj Balu
    Fade Slider
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anandaraj Balu Fade Slider fade-slider allows Reflected XSS.This issue affects Fade Slider: from n/a through <= 2.5.

  • CVE-2025-49955HigOct 22, 2025
    Rajan Vijayan
    WP Smart Flexslider
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rajan Vijayan WP Smart Flexslider wp-smart-flexslider allows Reflected XSS.This issue affects WP Smart Flexslider: from n/a through <= 2.5.

  • CVE-2025-49954HigOct 22, 2025
    WordPress
    Wp Click Tracker
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mithra62 WP-Click-Tracker wp-click-track allows Reflected XSS.This issue affects WP-Click-Tracker: from n/a through <= 0.7.3.

  • CVE-2025-49953HigOct 22, 2025
    WordPress
    Sharebang
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeinity ShareBang, Ultimate Social Share Buttons for WordPress sharebang allows Reflected XSS.This issue affects ShareBang, Ultimate Social Share Buttons for WordPress: from…

  • CVE-2025-49951HigOct 22, 2025
    WordPress
    Gappointments
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpcrunch gAppointments gAppointments allows Reflected XSS.This issue affects gAppointments: from n/a through <= 1.14.1.

  • CVE-2025-49950HigOct 22, 2025
    billingo
    Official Integration for Billingo
    risk 0.47cvss 7.2epss 0.00

    Missing Authorization vulnerability in billingo Official Integration for Billingo billingo allows Privilege Escalation.This issue affects Official Integration for Billingo: from n/a through <= 4.3.0.

  • CVE-2025-49948HigOct 22, 2025
    Ahmad Awais
    WP Super Edit
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ahmad Awais WP Super Edit wp-super-edit allows Reflected XSS.This issue affects WP Super Edit: from n/a through <= 2.5.4.

  • CVE-2025-49947HigOct 22, 2025
    extendons
    WooCommerce Registration Fields Plugin - Custom Signup Fields
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in extendons WooCommerce Registration Fields Plugin - Custom Signup Fields extendons-registration-fields allows Reflected XSS.This issue affects WooCommerce Registration Fields…

  • CVE-2025-49946HigOct 22, 2025
    WordPress
    Auto Login After Registration
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy Auto Login After Registration auto-login-after-registration allows Reflected XSS.This issue affects Auto Login After Registration: from n/a through <= 1.0.0.

  • CVE-2025-49945HigOct 22, 2025
    WordPress
    Shortcode Generator
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kylegetson Shortcode Generator shortcode-generator allows Reflected XSS.This issue affects Shortcode Generator: from n/a through <= 1.1.

  • CVE-2025-49944HigOct 22, 2025
    Jonatan Jumbert
    WPCode Content Ratio
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonatan Jumbert WPCode Content Ratio wpcode-content-ratio allows Reflected XSS.This issue affects WPCode Content Ratio: from n/a through <= 2.0.

  • CVE-2025-49935HigOct 22, 2025
    Xtemos
    Woodmart
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in xtemos WoodMart woodmart allows PHP Local File Inclusion.This issue affects WoodMart: from n/a through < 8.3.2.

  • CVE-2025-49930HigOct 22, 2025
    Crocoblock
    JetSearch
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Reflected XSS.This issue affects JetSearch: from n/a through <= 3.5.10.

  • CVE-2025-49926HigOct 22, 2025
    WordPress
    Kalium
    risk 0.47cvss 7.2epss 0.00

    Improper Control of Generation of Code ('Code Injection') vulnerability in Laborator Kalium kalium allows Code Injection.This issue affects Kalium: from n/a through <= 3.25.

  • CVE-2025-49925HigOct 22, 2025
    Vibethemes
    WPLMS
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in VibeThemes WPLMS wplms_plugin allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPLMS: from n/a through <= 1.9.9.7.

  • CVE-2025-49924HigOct 22, 2025
    Rymera
    Wholesale Suite
    risk 0.47cvss 7.2epss 0.00

    Incorrect Privilege Assignment vulnerability in Josh Kohlbach Wholesale Suite woocommerce-wholesale-prices allows Privilege Escalation.This issue affects Wholesale Suite: from n/a through <= 2.2.4.2.

  • CVE-2025-49921HigOct 22, 2025
    Crocoblock
    JetReviews
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 3.0.0.

  • CVE-2025-49916HigOct 22, 2025
    WordPress
    Dc Woocommerce Multi Vendor
    risk 0.56cvss 8.6epss 0.00

    Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects MultiVendorX: from n/a through <= 4.2.23.

  • CVE-2025-49911HigOct 22, 2025
    wpinstinct
    WooCommerce Vehicle Parts Finder
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpinstinct WooCommerce Vehicle Parts Finder woo-vehicle-parts-finder allows Reflected XSS.This issue affects WooCommerce Vehicle Parts Finder: from n/a through <= 3.7.

  • CVE-2025-49910HigOct 22, 2025
    AmentoTech
    WPGuppy
    risk 0.53cvss 8.2epss 0.00

    Missing Authorization vulnerability in AmentoTech Private Limited WPGuppy wpguppy-lite allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPGuppy: from n/a through <= 1.1.4.

  • CVE-2025-49378HigOct 22, 2025
    WordPress
    Hydra Booking
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.10.

  • CVE-2025-48338HigOct 22, 2025
    Kevonadonis
    Wp Abstracts
    risk 0.49cvss 7.5epss 0.00

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kevon Adonis WP Abstracts wp-abstracts-manuscripts-manager allows PHP Local File Inclusion.This issue affects WP Abstracts: from n/a through <= 2.7.4.

  • CVE-2025-48098HigOct 22, 2025
    Ays Pro
    Survey Maker
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey Maker survey-maker allows Stored XSS.This issue affects Survey Maker: from n/a through <= 5.1.8.8.

  • CVE-2025-48097HigOct 22, 2025
    Shiva
    WSAnalytics
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shiva WSAnalytics wsanalytics-google-analytics-and-dashboards allows Reflected XSS.This issue affects WSAnalytics: from n/a through <= 1.1.2.

  • CVE-2025-48093HigOct 22, 2025
    Calvaweb
    Password only login
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Calvaweb Password only login password-only-login allows Reflected XSS.This issue affects Password only login: from n/a through <= 0.2.

  • CVE-2025-48092HigOct 22, 2025
    jurajpuchky
    Fix Multiple Redirects
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jurajpuchky Fix Multiple Redirects fix-multiple-redirects allows Reflected XSS.This issue affects Fix Multiple Redirects: from n/a through <= 1.2.3.

  • CVE-2025-48091HigOct 22, 2025
    WordPress
    Anycomment
    risk 0.55cvss 8.5epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alexander AnyComment anycomment allows SQL Injection.This issue affects AnyComment: from n/a through <= 0.3.6.

  • CVE-2025-48082HigOct 22, 2025
    Progress (organisation)
    Progress
    risk 0.57cvss 8.8epss 0.00

    Incorrect Privilege Assignment vulnerability in Progress Planner Progress Planner progress-planner allows Privilege Escalation.This issue affects Progress Planner: from n/a through <= 1.8.0.

  • CVE-2025-39534HigOct 22, 2025
    WordPress
    Terms Dictionary
    risk 0.46cvss 7.1epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Somonator Terms Dictionary terms-dictionary allows Reflected XSS.This issue affects Terms Dictionary: from n/a through <= 1.5.1.

  • CVE-2025-32657HigOct 22, 2025
    WordPress
    Testimonial Slider And Showcase
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in RadiusTheme Testimonial Slider And Showcase Pro testimonial-slider-showcase-pro allows PHP Local File Inclusion.This issue affects Testimonial Slider And…

  • CVE-2025-32283HigOct 22, 2025
    designthemes
    Solar Energy
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.

  • CVE-2025-31634HigOct 22, 2025
    designthemes
    Insurance
    risk 0.57cvss 8.8epss 0.01

    Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.

  • CVE-2025-30944HigOct 22, 2025
    WordPress
    Tablesome Premium
    risk 0.49cvss 7.5epss 0.00

    Missing Authorization vulnerability in Essekia Tablesome Table Premium tablesome-premium allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tablesome Table Premium: from n/a through <= 1.1.23.

  • CVE-2025-61035HigOct 22, 2025
    risk 0.50cvss 7.7epss 0.00

    The seffaflik thru 0.0.9 is vulnerable to symlink attacks due to incorrect default permissions given to the .kimlik file and .seffaflik file, which is created with mode 0777 and 0775 respectively, exposing secrets to other local users. Additionally, the .kimlik file is written…

  • CVE-2025-11086HigOct 22, 2025
    Academy LMS
    Academy LMS – WordPress LMS Plugin for Complete eLearning Solution
    risk 0.53cvss 8.1epss 0.00

    The Academy LMS – WordPress LMS Plugin for Complete eLearning Solution plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.3.7. This is due to the plugin not properly validating a user's role prior to registering a user via the…

  • CVE-2025-41724HigOct 22, 2025
    risk 0.49cvss 7.5epss 0.00

    An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.

  • CVE-2025-41722HigOct 22, 2025
    Sauter Controls
    wsc server
    risk 0.49cvss 7.5epss 0.00

    The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.

  • CVE-2025-41719HigOct 22, 2025
    risk 0.57cvss 8.8epss 0.01

    A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password.

  • CVE-2025-62775HigOct 22, 2025
    Mercku
    M6a
    risk 0.52cvss 8.0epss 0.00

    Mercku M6a devices through 2.1.0 allow root TELNET logins via the web admin password.

  • CVE-2025-62771HigOct 22, 2025
    Mercku
    M6a
    risk 0.49cvss 7.5epss 0.00

    Mercku M6a devices through 2.1.0 allow password changes via intranet CSRF attacks.

  • CVE-2024-58274HigOct 22, 2025
    Hikvision
    iSecure Center
    risk 0.54cvss 8.3epss 0.18

    Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025.

  • CVE-2023-53691HigOct 22, 2025
    Hikvision
    CSMP (Comprehensive Security Management Platform) iSecure Center
    risk 0.54cvss 8.3epss 0.01

    Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2023-06-25 allows file upload via /center/api/files directory traversal, as exploited in the wild in 2024 and 2025.

  • CVE-2025-53066HigOct 21, 2025
    Sun Corporation
    Java Se
    risk 0.49cvss 7.5epss 0.01

    Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Oracle Java SE: 8u461, 8u461-perf, 11.0.28, 17.0.16, 21.0.8, 25; Oracle GraalVM for JDK: 17.0.16…

  • CVE-2025-60507HigOct 21, 2025
    Moodle
    Moodle
    risk 0.58cvss 8.9epss 0.00

    Cross site scripting vulnerability in Moodle GeniAI plugin (local_geniai) 2.3.6. An authenticated user with Teacher role can upload a PDF containing embedded JavaScript. The assistant outputs a direct HTML link to the uploaded file without sanitization. When other users…