VYPR

CVEs

413,450 total · page 2323 of 8,269

AllCriticalHighKEV
  • CVE-2025-58625MedSep 3, 2025
    WordPress
    WP Flow Plus
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spiffy Plugins WP Flow Plus wp-imageflow2 allows Stored XSS.This issue affects WP Flow Plus: from n/a through <= 5.2.5.

  • CVE-2025-58624MedSep 3, 2025
    WordPress
    Exchange Rates
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falselight Exchange Rates exchange-rates allows Stored XSS.This issue affects Exchange Rates: from n/a through <= 1.2.5.

  • CVE-2025-58623MedSep 3, 2025
    WordPress
    Event Feed For Eventbrite
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bohemia Plugins Event Feed for Eventbrite event-feed-for-eventbrite allows DOM-Based XSS.This issue affects Event Feed for Eventbrite: from n/a through <= 1.3.2.

  • CVE-2025-58622MedSep 3, 2025
    WordPress
    Mobile Contact Line
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile Contact Line: from n/a through <= 2.4.0.

  • CVE-2025-58621MedSep 3, 2025
    WordPress
    PuzzleMe for WordPress
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amuse Labs PuzzleMe for WordPress puzzleme allows Stored XSS.This issue affects PuzzleMe for WordPress: from n/a through <= 1.2.0.

  • CVE-2025-58620MedSep 3, 2025
    WordPress
    PDF For Wpforms
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored XSS.This issue affects PDF for WPForms: from n/a through <= 6.2.1.

  • CVE-2025-58618MedSep 3, 2025
    WordPress
    Pie Calendar
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar allows DOM-Based XSS.This issue affects Pie Calendar: from n/a through <= 1.2.8.

  • CVE-2025-58617MedSep 3, 2025
    WordPress
    F4 Media Taxonomies
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F4 Media Taxonomies: from n/a through <= 1.1.4.

  • CVE-2025-58616MedSep 3, 2025
    WordPress
    Reepay Checkout Gateway
    risk 0.42cvss 6.5epss 0.00

    Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frisbii Pay: from n/a through <= 1.8.2.1.

  • CVE-2025-58615MedSep 3, 2025
    WordPress
    Wp Bannerize Pro
    risk 0.29cvss 4.4epss 0.00

    Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Bannerize Pro: from n/a through <= 1.10.0.

  • CVE-2025-58614MedSep 3, 2025
    WordPress
    Tooltipy
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.

  • CVE-2025-58613MedSep 3, 2025
    WordPress
    Posts Table with Search & Sort
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.

  • CVE-2025-58612MedSep 3, 2025
    WordPress
    Propertyhive
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.5.

  • CVE-2025-58611MedSep 3, 2025
    WordPress
    Tickera
    risk 0.21cvss 4.3epss 0.00

    Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera: from n/a through <= 3.5.5.6.

  • CVE-2025-58610MedSep 3, 2025
    WordPress
    Photoblocks Grid Gallery
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.

  • CVE-2025-58609MedSep 3, 2025
    WordPress
    Latest Post Shortcode
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.

  • CVE-2025-58608HigSep 3, 2025
    WordPress
    Mediapress
    risk 0.49cvss 7.5epss 0.01

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in BuddyDev MediaPress mediapress allows PHP Local File Inclusion.This issue affects MediaPress: from n/a through <= 1.5.9.1.

  • CVE-2025-58607MedSep 3, 2025
    WordPress
    Cookie Notice & Consent Banner for GDPR & CCPA Compliance
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Consent Banner for GDPR…

  • CVE-2025-58606MedSep 3, 2025
    WordPress
    Saaslauncher
    risk 0.33cvss 5.0epss 0.00

    Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.

  • CVE-2025-58605MedSep 3, 2025
    WordPress
    WP Delicious
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.

  • CVE-2025-58604HigSep 3, 2025
    WordPress
    Mail Mint
    risk 0.49cvss 7.6epss 0.00

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPFunnels Mail Mint mail-mint allows SQL Injection.This issue affects Mail Mint: from n/a through <= 1.18.5.

  • CVE-2025-58603MedSep 3, 2025
    WordPress
    Surferseo
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.

  • CVE-2025-58602MedSep 3, 2025
    WordPress
    If-So Dynamic Content Personalization
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a through <= 1.9.4.

  • CVE-2025-58601MedSep 3, 2025
    WordPress
    Classified Listing
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.

  • CVE-2025-58600MedSep 3, 2025
    WordPress
    Paid Member Subscriptions
    risk 0.34cvss 5.3epss 0.00

    Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.

  • CVE-2025-58599MedSep 3, 2025
    WordPress
    Order Delivery Date For Woocommerce
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from n/a through <= 4.1.0.

  • CVE-2025-58598MedSep 3, 2025
    WordPress
    Klarna Order Management For Woocommerce
    risk 0.43cvss 6.6epss 0.00

    Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce klarna-order-management-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Klarna Order Management for WooCommerce: from n/a through <=…

  • CVE-2025-58597MedSep 3, 2025
    Tomdever
    Wpforo Forum
    risk 0.28cvss 4.3epss 0.00

    Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.

  • CVE-2025-58596MedSep 3, 2025
    WordPress
    Mailoptin
    risk 0.38cvss 5.9epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.

  • CVE-2025-58594MedSep 3, 2025
    WordPress
    Brizy
    risk 0.28cvss 4.3epss 0.00

    Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.

  • CVE-2025-58593MedSep 3, 2025
    WordPress
    Orbit Fox by ThemeIsle
    risk 0.42cvss 6.5epss 0.00

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.

  • CVE-2025-58460MedSep 3, 2025
    Jenkins Project
    Opentelemetry
    risk 0.20cvss 4.2epss 0.00

    A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials…

  • CVE-2025-58459MedSep 3, 2025
    Jenkins Project
    global-build-stats Plugin
    risk 0.21cvss 4.3epss 0.00

    Jenkins global-build-stats Plugin 322.v22f4db_18e2dd and earlier does not perform permission checks in its REST API endpoints, allowing attackers with Overall/Read permission to enumerate graph IDs.

  • CVE-2025-58458MedSep 3, 2025
    Jenkins Project
    Git Client
    risk 0.21cvss 4.3epss 0.00

    In Jenkins Git client Plugin 6.3.2 and earlier, except 6.1.4 and 6.2.1, Git URL field form validation responses differ based on whether the specified file path exists on the controller when specifying `amazon-s3` protocol for use with JGit, allowing attackers with Overall/Read…

  • CVE-2025-57151HigSep 3, 2025
    Phpgurukul
    Complaint Management System
    risk 0.57cvss 8.8epss 0.01

    phpgurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/userprofile.php via the fullname parameter.

  • CVE-2025-57150HigSep 3, 2025
    Phpgurukul
    Complaint Management System
    risk 0.47cvss 7.2epss 0.01

    phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting (XSS) in admin/subcategory.php via the categoryName parameter.

  • CVE-2025-57149MedSep 3, 2025
    Phpgurukul
    Complaint Management System
    risk 0.42cvss 6.5epss 0.00

    phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter.

  • CVE-2025-57148CriSep 3, 2025
    Phpgurukul
    Online Shopping Portal
    risk 0.59cvss 9.1epss 0.00

    phpgurukul Online Shopping Portal 2.0 is vulnerable to Arbitrary File Upload in /admin/insert-product.php, due to the lack of extension validation.

  • CVE-2025-57147HigSep 3, 2025
    Phpgurukul
    Complaint Management System
    risk 0.49cvss 7.5epss 0.00

    A SQL Injection vulnerability was found in phpgurukul Complaint Management System 2.0. The vulnerability is due to lack of input validation of multiple parameters including fullname, email, and contactno in user/registration.php.

  • CVE-2025-57146HigSep 3, 2025
    Phpgurukul
    Complaint Management System
    risk 0.53cvss 8.1epss 0.00

    phpgurukul Complaint Management System in PHP 2.0 is vulnerable to SQL Injection in user/reset-password.php via the mobileno parameter.

  • CVE-2025-57052CriSep 3, 2025
    CJSON
    cJSON
    risk 0.64cvss 9.8epss 0.01

    cJSON 1.5.0 through 1.7.18 allows out-of-bounds access via the decode_array_index_from_pointer function in cJSON_Utils.c, allowing remote attackers to bypass array bounds checking and access restricted data via malformed JSON pointer strings containing alphanumeric characters.

  • CVE-2025-56608MedSep 3, 2025
    Sourcecodester
    Corona Virus Tracker App India
    risk 0.27cvss 4.2epss 0.00

    The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm…

  • CVE-2025-9822MedSep 3, 2025
    Mautic
    Mautic
    risk 0.29cvss 5.5epss 0.00

    SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, can disclose them.

  • CVE-2025-47421HigSep 3, 2025
    Crestron
    TOUCHSCREENS x70
    risk 0.56cvss —epss 0.00

    Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in CRESTRON TOUCHSCREENS x70 allows Argument Injection.This issue affects TOUCHSCREENS x70: from 3.001.0031.001 through 3.001.0034.001. A specially crafted SCP command sent via SSH…

  • CVE-2025-2416HigSep 3, 2025
    Akinsoft
    LimonDesk
    risk 0.56cvss 8.6epss 0.00

    Improper Restriction of Excessive Authentication Attempts vulnerability in Akinsoft LimonDesk allows Authentication Bypass. This issue affects LimonDesk: from s1.02.14 before v1.02.17.

  • CVE-2025-26210HigSep 3, 2025
    DeepSeek
    Deepseek R1
    risk 0.57cvss 8.8epss 0.01

    DeepSeek R1 through V3.1 allows XSS, as demonstrated by JavaScript execution in the context of the run-html-chat.deepseeksvc.com domain. NOTE: some third parties have indicated that this is intended behavior.

  • CVE-2025-0878MedSep 3, 2025
    Akinsoft
    LimonDesk
    risk 0.31cvss 4.7epss 0.00

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS). This issue affects LimonDesk: from s1.02.14 before v1.02.17.

  • CVE-2024-13068HigSep 3, 2025
    Akinsoft
    LimonDesk
    risk 0.47cvss 7.3epss 0.00

    Origin Validation Error vulnerability in Akinsoft LimonDesk allows Forceful Browsing. This issue affects LimonDesk: from s1.02.14 before v1.02.17.

  • CVE-2025-9901MedSep 3, 2025
    GNOME Foundation
    Libsoup
    risk 0.38cvss 5.9epss 0.00

    A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this check, cached…

  • CVE-2025-53694HigSep 3, 2025
    Sitecore
    Experience Platform (XP)
    risk 0.49cvss 7.5epss 0.07

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP).This issue affects Sitecore Experience Manager (XM): from 9.2 through 10.4; Experience Platform (XP): from 9.2 through 10.4.