CVE-2025-22xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

901 records · Page 2 of 10

• CVE-2025-22841: Arkcompiler Ets Runtime has an out-of-bounds read vulnerability 3.3 Low

  in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read.

  Updated 2025-03-04
• CVE-2025-22840: Sequence of processor instructions leads to unexpected behavior for some Intel(R) Xeon(R) 6 Scalable processors may allow an authenticated user to potentially enable escalation of 5.3 Medium

  Sequence of processor instructions leads to unexpected behavior for some Intel(R) Xeon(R) 6 Scalable processors may allow an authenticated user to potentially enable escalation of privilege via local access

  Updated 2026-02-26
• CVE-2025-22839: Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege 7.3 High

  Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a privileged user to potentially enable escalation of privilege via adjacent access.

  Updated 2026-02-26
• CVE-2025-22838: Uncontrolled search path for some Intel(R) RealSense(TM) Dynamic Calibrator software before version 2.14.2.0 may allow an authenticated user to potentially enable escalation of pri 5.4 Medium

  Uncontrolled search path for some Intel(R) RealSense(TM) Dynamic Calibrator software before version 2.14.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  Updated 2025-08-12
• CVE-2025-22837: Arkcompiler Ets Runtime has a NULL pointer dereference vulnerability 3.3 Low

  in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference.

  Updated 2025-03-04
• CVE-2025-22836: Integer overflow or wraparound in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potentially enable esc 8.8 High

  Integer overflow or wraparound in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

  Updated 2026-02-26
• CVE-2025-22835: Arkcompiler Ets Runtime has an out-of-bounds write vulnerability 3.8 Low

  in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability can be exploited only in restricted scenarios.

  Updated 2025-03-11
• CVE-2025-22834: ThirdPartyVideo SetVariable Vulnerability 4.2 Medium

  AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability may leave the resource in an unexpected state and potentially impact confidentiality, integrity, and availability.

  Updated 2025-08-12
• CVE-2025-22833: FixupArray Pointer Validation in NTFS 4.6 Medium

  APTIOV contains a vulnerability in BIOS where an attacker may cause a Buffer Copy without Checking Size of Input by local accessing. Successful exploitation of this vulnerability may lead to arbitrary code execution.

  Updated 2025-10-14
• CVE-2025-22832: Buffer Overflow in NTFS when parsing the ATTRIBUTE_LIST 5.8 Medium

  APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.

  Updated 2025-10-14
• CVE-2025-22831: Buffer Overflow in NTFS when parsing the VOLUME_NAME 5.8 Medium

  APTIOV contains a vulnerability in BIOS where an attacker may cause an Out-of-bounds Write by local. Successful exploitation of this vulnerability may lead to data corruption and loss of availability.

  Updated 2025-10-14
• CVE-2025-22830: SmiFlash Race Condition Vulnerability 7.3 High

  APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may lead to resource exhaustion and impact Confidentiality, Integrity, and Availability.

  Updated 2025-08-12
• CVE-2025-22829: Apache CloudStack: Unauthorised access to dedicated resources in Quota plugin 2.3 Low

  The CloudStack Quota plugin has an improper privilege management logic in version 4.20.0.0. Anyone with authenticated user-account access in CloudStack 4.20.0.0 environments, where this plugin is enabled and have access to specific APIs can enable or disable reception of quota-related emails for any account in the environment and list their configurations. Quota plugin users using CloudStack 4.20

  Updated 2025-06-11
• CVE-2025-22828: Apache CloudStack: Unauthorised access to annotations 4.3 Medium

  CloudStack users can add and read comments (annotations) on resources they are authorised to access.  Due to an access validation issue that affects Apache CloudStack versions from 4.16.0, users who have access, prior access or knowledge of resource UUIDs can list and add comments (annotations) to such resources.  An attacker with a user-account and access or prior knowledge of resource UUIDs ma

  Updated 2025-01-13
• CVE-2025-22827: WordPress WP Joomag plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in joomag WP Joomag wp-joomag allows DOM-Based XSS.This issue affects WP Joomag: from n/a through <= 2.5.2.

  Updated 2026-04-28
• CVE-2025-22826: WordPress Sell Digital Downloads plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpecommerce Sell Digital Downloads sell-digital-downloads allows Stored XSS.This issue affects Sell Digital Downloads: from n/a through <= 2.2.7.

  Updated 2026-05-11
• CVE-2025-22825: WordPress Flexible PDF Coupons plugin < 1.10.3 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdesk Flexible PDF Coupons flexible-coupons allows Stored XSS.This issue affects Flexible PDF Coupons: from n/a through < 1.10.3.

  Updated 2026-04-28
• CVE-2025-22824: WordPress Live Flight Radar Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lucia.intelisano Live Flight Radar live-flight-radar allows Stored XSS.This issue affects Live Flight Radar: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-22823: WordPress Genesis Style Shortcodes Plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jtwerdy Genesis Style Shortcodes genesis-style-shortcodes allows DOM-Based XSS.This issue affects Genesis Style Shortcodes: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-22822: WordPress wp custom countdown Plugin <= 2.8 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bishawjit-das wp custom countdown wp-custom-countdown allows Stored XSS.This issue affects wp custom countdown: from n/a through <= 2.8.

  Updated 2026-04-28
• CVE-2025-22821: WordPress StorePress theme <= 1.0.12 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vfthemes StorePress storepress allows DOM-Based XSS.This issue affects StorePress: from n/a through <= 1.0.12.

  Updated 2026-04-28
• CVE-2025-22820: WordPress VR Views plugin <= 1.5.1 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in goldsounds VR Views vr-views allows Stored XSS.This issue affects VR Views: from n/a through <= 1.5.1.

  Updated 2026-04-28
• CVE-2025-22819: WordPress Qr Code and Barcode Scanner Reader plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roberto Bottalico Qr Code and Barcode Scanner Reader qr-code-and-barcode-scanner-reader allows Stored XSS.This issue affects Qr Code and Barcode Scanner Reader: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-22818: WordPress S3Player plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in S3Bubble S3Player – WooCommerce & Elementor Integration drm-protected-video-streaming allows Stored XSS.This issue affects S3Player – WooCommerce & Elementor Integration: from n/a through <= 4.2.1.

  Updated 2026-04-28
• CVE-2025-22817: WordPress BP Profile Shortcodes Extra plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Venutius BP Profile Shortcodes Extra bp-profile-shortcodes-extra allows Stored XSS.This issue affects BP Profile Shortcodes Extra: from n/a through <= 2.6.0.

  Updated 2026-04-28
• CVE-2025-22816: WordPress Power Mag theme <= 1.1.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetrendy Power Mag power-mag allows DOM-Based XSS.This issue affects Power Mag: from n/a through <= 1.1.5.

  Updated 2026-04-28
• CVE-2025-22815: WordPress Button Block plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through <= 1.1.9.

  Updated 2026-05-11
• CVE-2025-22814: WordPress Zephyr Admin Theme Plugin <= 1.4.1 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Dylan James Zephyr Admin Theme zephyr-modern-admin-theme allows Cross Site Request Forgery.This issue affects Zephyr Admin Theme: from n/a through <= 1.4.1.

  Updated 2026-04-28
• CVE-2025-22813: WordPress ChatBot Conversational Forms plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Stored XSS.This issue affects Conversational Forms for ChatBot: from n/a through <= 1.4.2.

  Updated 2026-04-28
• CVE-2025-22812: WordPress News Ticker Widget for Elementor plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aezaz Shaikh News Ticker Widget for Elementor news-ticker-widget-for-elementor allows Stored XSS.This issue affects News Ticker Widget for Elementor: from n/a through <= 1.3.2.

  Updated 2026-04-28
• CVE-2025-22811: WordPress MT Addons for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Stan MT Addons for Elementor mt-addons-for-elementor allows Stored XSS.This issue affects MT Addons for Elementor: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2025-22810: WordPress Content Blocks Builder plugin <= 2.7.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Phi Phan Content Blocks Builder content-blocks-builder allows Stored XSS.This issue affects Content Blocks Builder: from n/a through <= 2.7.6.

  Updated 2026-04-28
• CVE-2025-22809: WordPress PDF Catalog Woocommerce plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theme funda PDF Catalog Woocommerce pdf-catalog-woocommerce allows DOM-Based XSS.This issue affects PDF Catalog Woocommerce: from n/a through <= 2.0.

  Updated 2026-04-28
• CVE-2025-22808: WordPress Surbma | Premium WP plugin <= 9.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Surbma Surbma | Premium WP surbma-premium-wp allows DOM-Based XSS.This issue affects Surbma | Premium WP: from n/a through <= 9.0.

  Updated 2026-04-28
• CVE-2025-22807: WordPress Responsive Flickr Slideshow Plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Responsive Flickr Slideshow mobile-friendly-flickr-slideshow allows Stored XSS.This issue affects Responsive Flickr Slideshow: from n/a through <= 2.6.0.

  Updated 2026-04-28
• CVE-2025-22806: WordPress Black Widgets For Elementor plugin <= 1.3.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widgets allows DOM-Based XSS.This issue affects Black Widgets For Elementor: from n/a through <= 1.3.8.

  Updated 2026-04-28
• CVE-2025-22805: WordPress Skill Bar Plugin <= 1.2 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Skill Bar skillbars allows Stored XSS.This issue affects Skill Bar: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2025-22804: WordPress Author Avatars List/Block plugin <= 2.1.23 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Stored XSS.This issue affects Author Avatars List/Block: from n/a through <= 2.1.23.

  Updated 2026-04-28
• CVE-2025-22803: WordPress Advanced Product Information for WooCommerce plugin <= 1.1.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Advanced Product Information for WooCommerce woo-advanced-product-information allows Stored XSS.This issue affects Advanced Product Information for WooCommerce: from n/a through <= 1.1.4.

  Updated 2026-04-28
• CVE-2025-22802: WordPress Email Templates Customizer YeeMail plugin <= 2.1.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail yeemail allows Stored XSS.This issue affects Email Templates Customizer for WordPress – Drag And Drop Email Templates Builder – YeeMail: from n/a through <= 2.1.4.

  Updated 2026-04-28
• CVE-2025-22801: WordPress Free WooCommerce Theme 99fy Extension plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes Free WooCommerce Theme 99fy Extension 99fy-core allows Stored XSS.This issue affects Free WooCommerce Theme 99fy Extension: from n/a through <= 1.2.8.

  Updated 2026-05-11
• CVE-2025-22800: WordPress Post SMTP plugin <= 2.9.11 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 2.9.11.

  Updated 2026-04-28
• CVE-2025-22799: WordPress Neon Product Designer Plugin <= 2.2.0 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vertim Neon Product Designer neon-product-designer-for-woocommerce allows SQL Injection.This issue affects Neon Product Designer: from n/a through <= 2.2.0.

  Updated 2026-04-28
• CVE-2025-22798: WordPress Responsive jQuery Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CHR Designer Responsive jQuery Slider responsive-jquery-slider allows Stored XSS.This issue affects Responsive jQuery Slider: from n/a through <= 1.1.1.

  Updated 2026-05-11
• CVE-2025-22797: WordPress Gallery and Lightbox plugin <= 1.0.14 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Oğulcan Özügenç Gallery and Lightbox gallery-and-lightbox allows Stored XSS.This issue affects Gallery and Lightbox: from n/a through <= 1.0.14.

  Updated 2026-04-28
• CVE-2025-22796: WordPress WP-Asambleas Plugin <= 2.85.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in platcom WP-Asambleas wp-asambleas allows Reflected XSS.This issue affects WP-Asambleas: from n/a through <= 2.85.0.

  Updated 2026-04-28
• CVE-2025-22795: WordPress Multilang Contact Form Plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Reflected XSS.This issue affects Multilang Contact Form: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2025-22794: WordPress World Cup Predictor Plugin <= 1.9.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows Reflected XSS.This issue affects World Cup Predictor: from n/a through <= 1.9.8.

  Updated 2026-04-28
• CVE-2025-22793: WordPress Bold pagos en linea Plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Bold pagos en linea bold-pagos-en-linea allows DOM-Based XSS.This issue affects Bold pagos en linea: from n/a through <= 3.1.4.

  Updated 2026-04-29
• CVE-2025-22792: WordPress Js O3 Lite theme <= 1.5.8.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jinwen Js O3 Lite allows Reflected XSS.This issue affects Js O3 Lite: from n/a through 1.5.8.2.

  Updated 2026-04-28
• CVE-2025-22791: WordPress offset writing theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in twh offset writing allows Reflected XSS.This issue affects offset writing: from n/a through 1.2.

  Updated 2026-04-28
• CVE-2025-22790: WordPress moseter theme <= 1.3.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in asmedia allows Reflected XSS.This issue affects moseter: from n/a through 1.3.1.

  Updated 2026-04-28
• CVE-2025-22789: WordPress polka dots theme <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fyrewurks polka dots allows Reflected XSS.This issue affects polka dots: from n/a through 1.2.

  Updated 2026-04-28
• CVE-2025-22788: WordPress CoDesigner plugin <= 4.29 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codexpert, Inc CoDesigner woolementor allows Stored XSS.This issue affects CoDesigner: from n/a through <= 4.29.

  Updated 2026-04-28
• CVE-2025-22787: WordPress Button Block plugin <= 1.1.5 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in bPlugins Button Block button-block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through <= 1.1.5.

  Updated 2026-04-28
• CVE-2025-22786: WordPress ElementInvader Addons for Elementor plugin <= 1.2.6 - Local File Inclusion vulnerability 7.5 High

  Path Traversal: '.../...//' vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows PHP Local File Inclusion.This issue affects ElementInvader Addons for Elementor: from n/a through <= 1.2.6.

  Updated 2026-04-28
• CVE-2025-22785: WordPress Course Booking System plugin <= 6.0.6 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-system allows SQL Injection.This issue affects Course Booking System: from n/a through <= 6.0.6.

  Updated 2026-04-28
• CVE-2025-22784: WordPress Background Control plugin <= 1.0.5 - CSRF to Arbitrary File Deletion vulnerability 8.6 High

  Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Background Control background-control allows Path Traversal.This issue affects Background Control: from n/a through <= 1.0.5.

  Updated 2026-04-28
• CVE-2025-22783: WordPress SEO Plugin by Squirrly SEO plugin <= 12.4.03 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SEO Squirrly SEO Plugin by Squirrly SEO squirrly-seo allows SQL Injection.This issue affects SEO Plugin by Squirrly SEO: from n/a through <= 12.4.03.

  Updated 2026-04-28
• CVE-2025-22782: WordPress WR Price List Manager For Woocommerce plugin <= 1.0.8 - Remote Code Execution (RCE) vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Web Ready Now WR Price List Manager For Woocommerce wr-price-list-for-woocommerce allows Upload a Web Shell to a Web Server.This issue affects WR Price List Manager For Woocommerce: from n/a through <= 1.0.8.

  Updated 2026-04-28
• CVE-2025-22781: WordPress Nativery Plugin plugin <= 0.1.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nativery Nativery nativery allows DOM-Based XSS.This issue affects Nativery: from n/a through <= 0.1.6.

  Updated 2026-04-28
• CVE-2025-22780: WordPress wp-pano Plugin <= 1.17 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrey wp-pano wp-pano allows Stored XSS.This issue affects wp-pano: from n/a through <= 1.17.

  Updated 2026-05-11
• CVE-2025-22779: WordPress WP News Sliders plugin <= 1.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in codeaffairs WP News Sliders wp-news-sliders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP News Sliders: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-22778: WordPress Lijit Search Plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in damniel Lijit Search wp-lijit-wijit allows Reflected XSS.This issue affects Lijit Search: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2025-22777: WordPress GiveWP Plugin <= 3.19.3 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in StellarWP GiveWP give allows Object Injection.This issue affects GiveWP: from n/a through <= 3.19.3.

  Updated 2026-04-28
• CVE-2025-22776: WordPress WP Bulletin Board Plugin <= 1.1.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codebycarter WP Bulletin Board wp-bulletin-board allows Reflected XSS.This issue affects WP Bulletin Board: from n/a through <= 1.1.4.

  Updated 2026-04-28
• CVE-2025-22775: WordPress Catalog Importer, Scraper & Crawler Plugin <= 5.1.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in idiatech Catalog Importer, Scraper & Crawler intelligent-importer allows Reflected XSS.This issue affects Catalog Importer, Scraper & Crawler: from n/a through <= 5.1.3.

  Updated 2026-04-28
• CVE-2025-22774: WordPress CRUDLab Scroll to Top Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRUDLab CRUDLab Scroll to Top crudlab-scroll-to-top allows Reflected XSS.This issue affects CRUDLab Scroll to Top: from n/a through <= 1.0.1.

  Updated 2026-04-28
• CVE-2025-22773: WordPress Htaccess File Editor <= 1.0.19 - Broken Authentication vulnerability 5.3 Medium

  Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Chill Htaccess File Editor htaccess-file-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Htaccess File Editor: from n/a through <= 1.0.19.

  Updated 2026-04-29
• CVE-2025-22772: WordPress Mapbox for WP Advanced Plugin <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stephanemartinw Mapbox for WP Advanced mapbox-for-wp-advanced allows Reflected XSS.This issue affects Mapbox for WP Advanced: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-22771: WordPress The Great Firewords of China plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studio Hyperset The Great Firewords of China sensitive-chinese-words-scanner allows Stored XSS.This issue affects The Great Firewords of China: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2025-22770: WordPress Envo Multipurpose theme <= 1.1.6 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in EnvoThemes Envo Multipurpose allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Multipurpose: from n/a through 1.1.6.

  Updated 2026-04-28
• CVE-2025-22769: WordPress Multifox theme <= 1.3.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Brahma Multifox allows Stored XSS.This issue affects Multifox: from n/a through 1.3.7.

  Updated 2026-04-28
• CVE-2025-22768: WordPress Rocket Media Library Mime Type plugin <= 2.1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in JinHan Park Rocket Media Library Mime Type rocket-media-library-mime-type allows Stored XSS.This issue affects Rocket Media Library Mime Type: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-22767: WordPress GlobalPayments WooCommerce Plugin <= 1.13.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Reflected XSS.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.13.2.

  Updated 2026-05-12
• CVE-2025-22766: WordPress Zarinpal Paid Download Plugin <= 2.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Masoud Amini Zarinpal Paid Download zarinpal-paid-downloads allows Reflected XSS.This issue affects Zarinpal Paid Download: from n/a through <= 2.3.

  Updated 2026-04-28
• CVE-2025-22765: WordPress WP Order By Plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weiluri WP Order By wp-order-by allows Reflected XSS.This issue affects WP Order By: from n/a through <= 1.4.2.

  Updated 2026-04-28
• CVE-2025-22764: WordPress WP Post Corrector Plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vipul Jariwala WP Post Corrector wp-post-corrector allows Reflected XSS.This issue affects WP Post Corrector: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2025-22763: WordPress Brizy Pro Plugin <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound Brizy Pro allows Reflected XSS. This issue affects Brizy Pro: from n/a through 2.6.1.

  Updated 2026-04-28
• CVE-2025-22762: WordPress Octrace Support Pro plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Octrace WordPress HelpDesk & Support Ticket System Plugin – Octrace Support octrace-support allows Stored XSS.This issue affects WordPress HelpDesk & Support Ticket System Plugin – Octrace Support: from n/a through <= 1.2.7.

  Updated 2026-04-28
• CVE-2025-22761: WordPress Ajax Contact Form plugin <= 1.4.1 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Olaf Lederer Ajax Contact Form fws-ajax-contact-form allows Stored XSS.This issue affects Ajax Contact Form: from n/a through <= 1.4.1.

  Updated 2026-04-28
• CVE-2025-22760: WordPress CodeBard Help Desk plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Reflected XSS.This issue affects CodeBard Help Desk: from n/a through <= 1.1.2.

  Updated 2026-05-11
• CVE-2025-22759: WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin <= 1.27.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid post-and-page-builder allows Stored XSS.This issue affects Post and Page Builder by BoldGrid: from n/a through <= 1.27.5.

  Updated 2026-04-28
• CVE-2025-22758: WordPress Elementor AI Addons plugin <= 2.2.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Harnani Elementor AI Addons ai-addons-for-elementor allows DOM-Based XSS.This issue affects Elementor AI Addons: from n/a through <= 2.2.1.

  Updated 2026-04-28
• CVE-2025-22757: WordPress CodeBard Help Desk plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Stored XSS.This issue affects CodeBard Help Desk: from n/a through <= 1.1.2.

  Updated 2026-04-28
• CVE-2025-22756: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

  Updated 2025-05-14 · Rejected record
• CVE-2025-22755: WordPress WP Headmaster Plugin <= 0.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bavington WP Headmaster wp-headmaster allows Reflected XSS.This issue affects WP Headmaster: from n/a through <= 0.3.

  Updated 2026-04-28
• CVE-2025-22754: WordPress Amber Plugin <=1.4.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Berkman Klein Center Amber amberlink allows Reflected XSS.This issue affects Amber: from n/a through <= 1.4.4.

  Updated 2026-04-29
• CVE-2025-22753: WordPress turboSMTP Plugin <= 4.6 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in turboSMTP turboSMTP turbosmtp allows Reflected XSS.This issue affects turboSMTP: from n/a through <= 4.6.

  Updated 2026-04-28
• CVE-2025-22752: WordPress GSheetConnector for Forminator Forms Plugin <= 1.0.12 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WesternDeal GSheetConnector for Forminator Forms gsheetconnector-forminator allows Reflected XSS.This issue affects GSheetConnector for Forminator Forms: from n/a through <= 1.0.12.

  Updated 2026-04-28
• CVE-2025-22751: WordPress Partners Plugin <= 0.2.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in farinspace Partners partners allows Reflected XSS.This issue affects Partners: from n/a through <= 0.2.0.

  Updated 2026-04-28
• CVE-2025-22750: WordPress Post Carousel & Slider plugin <= 1.0.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Patel Post Carousel & Slider post-types-carousel-slider allows Reflected XSS.This issue affects Post Carousel & Slider: from n/a through <= 1.0.4.

  Updated 2026-05-11
• CVE-2025-22749: WordPress Social Media Engine plugin <= 1.0.2 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemesCraft.co Social Media Engine social-media-engine allows Stored XSS.This issue affects Social Media Engine: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2025-22748: WordPress SetMore Theme – Custom Post Types plugin <= 1.1 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Setmore SetMore Theme – Custom Post Types service-provider-profile-cpt allows Stored XSS.This issue affects SetMore Theme – Custom Post Types: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2025-22747: WordPress Foundation Columns plugin <= 0.8 - Stored Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten Foundation Columns foundation-columns allows Stored XSS.This issue affects Foundation Columns: from n/a through <= 0.8.

  Updated 2026-04-28
• CVE-2025-22746: WordPress HireHive Job Plugin plugin <= 2.9.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zartis HireHive Job Plugin zartis-job-plugin allows Stored XSS.This issue affects HireHive Job Plugin: from n/a through <= 2.9.0.

  Updated 2026-04-28
• CVE-2025-22745: WordPress Navigation Du Lapin Blanc plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bjoerne Navigation Du Lapin Blanc navigation-du-lapin-blanc allows DOM-Based XSS.This issue affects Navigation Du Lapin Blanc: from n/a through <= 1.1.1.

  Updated 2026-04-28
• CVE-2025-22744: WordPress S-DEV SEO plugin <= 1.88 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seodev S-DEV SEO s-dev-seo allows Stored XSS.This issue affects S-DEV SEO: from n/a through <= 1.88.

  Updated 2026-04-28
• CVE-2025-22743: WordPress Twitter Bootstrap Collapse aka Accordian Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mohsin Rasool Twitter Bootstrap Collapse aka Accordian Shortcode twitter-bootstrap-collapse-aka-accordian-shortcode allows DOM-Based XSS.This issue affects Twitter Bootstrap Collapse aka Accordian Shortcode: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-22742: WordPress WP ViewSTL plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in falldeaf WP ViewSTL wp-viewstl allows DOM-Based XSS.This issue affects WP ViewSTL: from n/a through <= 1.0.

  Updated 2026-04-28

Search a CVE ID or check dependency files →