CVE-2025-30xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

908 records · Page 5 of 10

• CVE-2025-30594: WordPress Include URL plugin <= 0.3.5 Arbitrary File Download Vulnerability 6.5 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in samsk Include URL include-url allows Path Traversal.This issue affects Include URL: from n/a through <= 0.3.5.

  Updated 2026-04-28
• CVE-2025-30593: WordPress Include URL plugin <= 0.3.5 Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk Include URL include-url allows Stored XSS.This issue affects Include URL: from n/a through <= 0.3.5.

  Updated 2026-04-28
• CVE-2025-30592: WordPress Advanced Dewplayer - plugin <= 1.6 Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in WesternDeal Advanced Dewplayer advanced-dewplayer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Dewplayer: from n/a through <= 1.6.

  Updated 2026-04-28
• CVE-2025-30591: WordPress Music Press Pro plugin <= 1.4.6 Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in tuyennv Music Press Pro music-press-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Press Pro: from n/a through <= 1.4.6.

  Updated 2026-04-28
• CVE-2025-30590: WordPress Flickr set slideshows plugin <= 0.9 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.

  Updated 2026-04-28
• CVE-2025-30589: WordPress Flickr set slideshows plugin <= 0.9 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Dourou Flickr set slideshows flickr-set-slideshows allows SQL Injection.This issue affects Flickr set slideshows: from n/a through <= 0.9.

  Updated 2026-04-28
• CVE-2025-30588: WordPress Map Contact plugin <= 3.0.4 - CSRF to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in ryan_xantoo Map Contact map-contact allows Stored XSS.This issue affects Map Contact: from n/a through <= 3.0.4.

  Updated 2026-04-28
• CVE-2025-30587: WordPress LH OGP Meta plugin <= 1.73 - CSRF to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in shawfactor LH OGP Meta lh-ogp-meta-tags allows Stored XSS.This issue affects LH OGP Meta: from n/a through <= 1.73.

  Updated 2026-04-28
• CVE-2025-30586: WordPress cTabs plugin <= 1.3 - CSRF to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in bbodine1 cTabs ctabs allows Stored XSS.This issue affects cTabs: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2025-30585: WordPress Generate Post Thumbnails plugin <= 0.8 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in marynixie Generate Post Thumbnails generate-post-thumbnails allows Cross Site Request Forgery.This issue affects Generate Post Thumbnails: from n/a through <= 0.8.

  Updated 2026-04-28
• CVE-2025-30584: WordPress AlphaOmega Captcha & Anti-Spam Filter plugin <= 3.3 - CSRF to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in alphaomegaplugins AlphaOmega Captcha & Anti-Spam Filter alphaomega-captcha-anti-spam allows Stored XSS.This issue affects AlphaOmega Captcha & Anti-Spam Filter: from n/a through <= 3.3.

  Updated 2026-04-28
• CVE-2025-30583: WordPress Pro Rank Tracker plugin <= 1.0.0 - CSRF to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in ProRankTracker Pro Rank Tracker proranktracker allows Stored XSS.This issue affects Pro Rank Tracker: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-30582: WordPress DyaPress ERP/CRM plugin <= 18.0.2.0 - Local File Inclusion Vulnerability 8.1 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclusion.This issue affects DyaPress ERP/CRM: from n/a through <= 18.0.2.0.

  Updated 2026-04-28
• CVE-2025-30581: WordPress Top Bar plugin <= 3.3 - Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in PluginOps Top Bar ultimate-bar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Top Bar: from n/a through <= 3.3.

  Updated 2026-04-28
• CVE-2025-30580: WordPress DigiWidgets Image Editor plugin <= 1.10 - Remote Code Execution (RCE) Vulnerability 10.0 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in kellydiek DigiWidgets Image Editor digiwidgets-image-editor allows Remote Code Inclusion.This issue affects DigiWidgets Image Editor: from n/a through <= 1.10.

  Updated 2026-04-28
• CVE-2025-30579: WordPress Pesapal Gateway for Woocommerce plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jakeii Pesapal Gateway for Woocommerce pesapal-for-woocommerce allows Reflected XSS.This issue affects Pesapal Gateway for Woocommerce: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-30578: WordPress AdSense Privacy Policy plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in hotvanrod AdSense Privacy Policy adsense-privacy-policy allows Stored XSS.This issue affects AdSense Privacy Policy: from n/a through <= 1.1.1.

  Updated 2026-04-28
• CVE-2025-30577: WordPress Browser Address Bar Color plugin <= 3.3 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in mendibass Browser Address Bar Color browser-address-bar-color allows Stored XSS.This issue affects Browser Address Bar Color: from n/a through <= 3.3.

  Updated 2026-04-28
• CVE-2025-30576: WordPress Hacklog Remote Image Autosave plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in HuangYe WuDeng Hacklog Remote Image Autosave hacklog-remote-image-autosave allows Cross Site Request Forgery.This issue affects Hacklog Remote Image Autosave: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-30575: WordPress Login Redirect plugin <= - 1.0.5 Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly Login Redirect login-redirect allows Stored XSS.This issue affects Login Redirect: from n/a through <= 1.0.5.

  Updated 2026-04-28
• CVE-2025-30574: WordPress Mobile Navigation plugin <= - 1.5 Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jenst Mobile Navigation mobile-navigation allows Stored XSS.This issue affects Mobile Navigation: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2025-30573: WordPress My Default Post Content plugin <= - 0.7.3 Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mrdenny My Default Post Content my-default-post-content allows Stored XSS.This issue affects My Default Post Content: from n/a through <= 0.7.3.

  Updated 2026-04-28
• CVE-2025-30572: WordPress Simple Rating plugin <= 1.4 - Cross Site Request Forgery (CSRF) to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Igor Yavych Simple Rating simple-rating allows Stored XSS.This issue affects Simple Rating: from n/a through <= 1.4.

  Updated 2026-04-28
• CVE-2025-30571: WordPress STEdb Forms plugin <= 1.0.4 - SQL Injection Vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in STEdb Corp. STEdb Forms stedb-forms allows SQL Injection.This issue affects STEdb Forms: from n/a through <= 1.0.4.

  Updated 2026-04-28
• CVE-2025-30570: WordPress دکمه، شبکه اجتماعی خرید plugin <= 2.0.6 - SQL Injection Vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AliRezaMohammadi دکمه، شبکه اجتماعی خرید dokme allows SQL Injection.This issue affects دکمه، شبکه اجتماعی خرید: from n/a through <= 2.0.6.

  Updated 2026-04-28
• CVE-2025-30569: WordPress WP Featured Entries plugin <= - 1.0 SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jahertor WP Featured Entries wp-featured-entries allows SQL Injection.This issue affects WP Featured Entries: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-30568: WordPress Super Static Cache plugin <= 3.3.5 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in hitoy Super Static Cache super-static-cache allows Cross Site Request Forgery.This issue affects Super Static Cache: from n/a through <= 3.3.5.

  Updated 2026-04-28
• CVE-2025-30567: WordPress WP01 plugin <= 2.6.2 - Arbitrary File Download Vulnerability 7.5 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP01 WP01 wp01 allows Path Traversal.This issue affects WP01: from n/a through <= 2.6.2.

  Updated 2026-04-28
• CVE-2025-30566: WordPress Clink plugin <= 1.2.2 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aryan Themes Clink clink allows DOM-Based XSS.This issue affects Clink: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-30565: WordPress banner-manager plugin <= 16.04.19 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in karrikas banner-manager banner-manager allows Stored XSS.This issue affects banner-manager: from n/a through <= 16.04.19.

  Updated 2026-04-28
• CVE-2025-30564: WordPress Custom Script Integration plugin <= - 2.1 Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in wpwox Custom Script Integration custom-script-integration allows Stored XSS.This issue affects Custom Script Integration: from n/a through <= 2.1.

  Updated 2026-04-28
• CVE-2025-30563: WordPress Tidekey plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in makong Tidekey tidekey allows Reflected XSS.This issue affects Tidekey: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2025-30562: WordPress Navigation Tree Elementor plugin <= 1.0.1 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdistillery Navigation Tree Elementor navigation-tree-elementor allows Blind SQL Injection.This issue affects Navigation Tree Elementor: from n/a through <= 1.0.1.

  Updated 2026-04-29
• CVE-2025-30561: WordPress CAS Maestro plugin <= 1.1.3 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Henrique Mouta CAS Maestro cas-maestro allows Stored XSS.This issue affects CAS Maestro: from n/a through <= 1.1.3.

  Updated 2026-04-28
• CVE-2025-30560: WordPress jQuery Dropdown Menu plugin <= 3.0 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Sana Ullah jQuery Dropdown Menu jquery-drop-down-menu-plugin allows Stored XSS.This issue affects jQuery Dropdown Menu: from n/a through <= 3.0.

  Updated 2026-04-28
• CVE-2025-30559: WordPress Kento WordPress Stats plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Kento WordPress Stats kento-wp-stats allows Stored XSS.This issue affects Kento WordPress Stats: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2025-30558: WordPress ANAC XML Render plugin <= 1.5.7 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in EnzoCostantini55 ANAC XML Render anac-xml-render allows Stored XSS.This issue affects ANAC XML Render: from n/a through <= 1.5.7.

  Updated 2026-04-28
• CVE-2025-30557: WordPress Easy 301 Redirects plugin <= 1.33 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in odihost Easy 301 Redirects odihost-easy-redirect-301 allows Cross Site Request Forgery.This issue affects Easy 301 Redirects: from n/a through <= 1.33.

  Updated 2026-04-28
• CVE-2025-30556: WordPress Fix Rss Feeds plugin <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in flyaga Fix Rss Feeds fix-rss-feed allows Cross Site Request Forgery.This issue affects Fix Rss Feeds: from n/a through <= 3.1.

  Updated 2026-04-28
• CVE-2025-30555: WordPress WordPres 同步微博 plugin <= 1.1.0 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in iiiryan WordPres 同步微博 wp2wb allows Stored XSS.This issue affects WordPres 同步微博: from n/a through <= 1.1.0.

  Updated 2026-05-11
• CVE-2025-30554: WordPress Frizzly plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abhishek Kumar Frizzly frizzly allows Reflected XSS.This issue affects Frizzly: from n/a through <= 1.1.0.

  Updated 2026-04-28
• CVE-2025-30553: WordPress GMO Font Agent plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Z.com byGMO GMO Font Agent gmo-font-agent allows Stored XSS.This issue affects GMO Font Agent: from n/a through <= 1.6.

  Updated 2026-04-28
• CVE-2025-30552: WordPress WordPress Admin Bar Improved plugin <= 3.3.5 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Donald Gilbert WordPress Admin Bar Improved wordpress-admin-bar-improved allows Stored XSS.This issue affects WordPress Admin Bar Improved: from n/a through <= 3.3.5.

  Updated 2026-04-28
• CVE-2025-30551: WordPress Pretty file links plugin <= 0.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartredfox Pretty file links pretty-file-links allows Stored XSS.This issue affects Pretty file links: from n/a through <= 0.9.

  Updated 2026-04-28
• CVE-2025-30550: WordPress CallPhone'r plugin <= 1.1.1 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in WPShop.ru CallPhone'r callphoner allows Stored XSS.This issue affects CallPhone'r: from n/a through <= 1.1.1.

  Updated 2026-04-28
• CVE-2025-30549: WordPress Yummly Rich Recipes plugin <= 4.2 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes yummly-rich-recipes allows Cross Site Request Forgery.This issue affects Yummly Rich Recipes: from n/a through <= 4.2.

  Updated 2026-04-28
• CVE-2025-30548: WordPress Advanced Post Search plugin <= 1.1.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VarDump s.r.l. Advanced Post Search advanced-post-search allows Reflected XSS.This issue affects Advanced Post Search: from n/a through <= 1.1.0.

  Updated 2026-04-28
• CVE-2025-30547: WordPress WP Cards plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Tufts WP Cards wp-cards allows Reflected XSS.This issue affects WP Cards: from n/a through <= 1.5.1.

  Updated 2026-04-28
• CVE-2025-30546: WordPress Cackle plugin <= 4.33 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in boroV Cackle cackle allows Cross Site Request Forgery.This issue affects Cackle: from n/a through <= 4.33.

  Updated 2026-05-11
• CVE-2025-30545: WordPress issuuPress plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixeline issuuPress issuupress allows Stored XSS.This issue affects issuuPress: from n/a through <= 1.3.2.

  Updated 2026-05-11
• CVE-2025-30544: WordPress OK Poster Group plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in svmidi OK Poster Group ok-poster-group allows Reflected XSS.This issue affects OK Poster Group: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2025-30543: WordPress Menu Duplicator plugin <= 1.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in swayam.tejwani Menu Duplicator copy-menu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Menu Duplicator: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-30542: WordPress WP SoundCloud Ultimate plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in wpsolutions SoundCloud Ultimate soundcloud-ultimate allows Cross Site Request Forgery.This issue affects SoundCloud Ultimate: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2025-30541: WordPress Info Boxes Shortcode And Widgets plugin <= 1.15 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in OTWthemes Info Boxes Shortcode and Widget info-boxes-shortcode-and-widget allows Cross Site Request Forgery.This issue affects Info Boxes Shortcode and Widget: from n/a through <= 1.15.

  Updated 2026-04-28
• CVE-2025-30540: WordPress AvaiBook plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in avaibook AvaiBook avaibook allows Stored XSS.This issue affects AvaiBook: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2025-30539: WordPress BMo Expo plugin <= 1.0.15 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Benedikt Mo BMo Expo bmo-expo allows Stored XSS.This issue affects BMo Expo: from n/a through <= 1.0.15.

  Updated 2026-04-28
• CVE-2025-30538: WordPress Simple Optimizer plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in ChrisHurst Simple Optimizer simple-optimizer allows Cross Site Request Forgery.This issue affects Simple Optimizer: from n/a through <= 1.2.7.

  Updated 2026-04-28
• CVE-2025-30537: WordPress Upload Quota per User plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cristian Sarov Upload Quota per User upload-quota-per-user allows Stored XSS.This issue affects Upload Quota per User: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2025-30536: WordPress Beautiful Link Preview plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zeitwesentech Beautiful Link Preview beautiful-link-preview allows Stored XSS.This issue affects Beautiful Link Preview: from n/a through <= 1.5.0.

  Updated 2026-04-28
• CVE-2025-30535: WordPress External image replace plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in muro External image replace external-image-replace allows Cross Site Request Forgery.This issue affects External image replace: from n/a through <= 1.0.8.

  Updated 2026-04-28
• CVE-2025-30534: WordPress Image Captcha plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in captcha.soft Image Captcha image-captcha allows Cross Site Request Forgery.This issue affects Image Captcha: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2025-30533: WordPress Message ticker plugin <= 9.3 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Message ticker message-ticker allows Stored XSS.This issue affects Message ticker: from n/a through <= 9.3.

  Updated 2026-04-28
• CVE-2025-30532: WordPress Weather Layer plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MorganF Weather Layer weather-layer allows Stored XSS.This issue affects Weather Layer: from n/a through <= 4.2.1.

  Updated 2026-04-28
• CVE-2025-30531: WordPress WP Ride Booking plugin <= 2.4 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in GBS Developer WP Ride Booking wp-ride-booking allows Cross Site Request Forgery.This issue affects WP Ride Booking: from n/a through <= 2.4.

  Updated 2026-04-28
• CVE-2025-30530: WordPress AI Preloader plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atikul AI Preloader ai-preloader allows Stored XSS.This issue affects AI Preloader: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2025-30529: WordPress Auto Load Next Post plugin <= 1.5.14 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Sébastien Dumont Auto Load Next Post auto-load-next-post allows Cross Site Request Forgery.This issue affects Auto Load Next Post: from n/a through <= 1.5.14.

  Updated 2026-04-28
• CVE-2025-30528: WordPress Awesome Logos plugin <= 1.2 - CSRF to SQL Injection vulnerability 9.3 Critical

  Cross-Site Request Forgery (CSRF) vulnerability in wpshopee Awesome Logos awesome-logos allows SQL Injection.This issue affects Awesome Logos: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2025-30527: WordPress My Bootstrap Menu plugin <= 1.2.1 - Stored Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codetoolbox My Bootstrap Menu my-bootstrap-menu allows Stored XSS.This issue affects My Bootstrap Menu: from n/a through <= 1.2.1.

  Updated 2026-04-28
• CVE-2025-30526: WordPress Typekit plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in lucksy Typekit plugin for WordPress typekit allows Cross Site Request Forgery.This issue affects Typekit plugin for WordPress: from n/a through <= 1.2.3.

  Updated 2026-05-11
• CVE-2025-30525: WordPress WP Profitshare plugin <= 1.4.9 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ProfitShare.ro WP Profitshare wp-profitshare allows SQL Injection.This issue affects WP Profitshare: from n/a through <= 1.4.9.

  Updated 2026-04-28
• CVE-2025-30524: WordPress Product Catalog plugin <= 1.0.4 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in origincode Product Catalog displayproduct allows SQL Injection.This issue affects Product Catalog: from n/a through <= 1.0.4.

  Updated 2026-04-28
• CVE-2025-30523: WordPress Super Simple Subscriptions plugin <= 1.1.0 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Marcel-NL Super Simple Subscriptions super-simple-subscriptions allows SQL Injection.This issue affects Super Simple Subscriptions: from n/a through <= 1.1.0.

  Updated 2026-04-28
• CVE-2025-30522: WordPress Contact Form 7 Material Design plugin <= 1.0.0 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Damian Orzol Contact Form 7 Material Design cf7-material-design allows Stored XSS.This issue affects Contact Form 7 Material Design: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-30521: WordPress GP Back To Top plugin <= 3.0 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in giangmd93 GP Back To Top gp-back-to-top allows Cross Site Request Forgery.This issue affects GP Back To Top: from n/a through <= 3.0.

  Updated 2026-04-28
• CVE-2025-30520: WordPress Breezing Forms plugin <= 1.2.8.11 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in crosstec Breezing Forms breezing-forms allows Reflected XSS.This issue affects Breezing Forms: from n/a through <= 1.2.8.11.

  Updated 2026-04-28
• CVE-2025-30519: Dover Fueling Solutions ProGauge MagLink LX4 Devices Use of Weak Credentials 9.3 Critical

  Dover Fueling Solutions ProGauge MagLink LX4 Devices have default root credentials that cannot be changed through standard administrative means. An attacker with network access to the device can gain administrative access to the system.

  Updated 2025-09-19
• CVE-2025-30518: Incorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversa 5.4 Medium

  Incorrect default permissions for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal kn

  Updated 2026-02-26
• CVE-2025-30517: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused Rejected

  This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused

  Updated 2026-02-13 · Rejected record
• CVE-2025-30516: Unauthorized Notification Exposure in Mobile App Under Specific Conditions 2.0 Low

  Mattermost Mobile Apps versions <=2.25.0  fail to terminate sessions during logout under certain conditions (e.g. poor connectivity), allowing unauthorized users on shared devices to access sensitive notification content via continued mobile notifications

  Updated 2025-04-14
• CVE-2025-30515: CyberData 011209 SIP Emergency Intercom Path Traversal 9.3 Critical

  CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system.

  Updated 2025-06-10
• CVE-2025-30514: Growatt Cloud portal Authorization Bypass Through User-Controlled Key 6.9 Medium

  Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "scenes").

  Updated 2025-04-16
• CVE-2025-30513: Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity a 8.4 High

  Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and requires no user interaction. The potential vulner

  Updated 2026-02-26
• CVE-2025-30512: Growatt Cloud portal External Control of System or Configuration Setting 6.9 Medium

  Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely (e.g., on/off).

  Updated 2025-04-16
• CVE-2025-30511: Growatt Cloud Applications Cross-site Scripting 8.7 High

  An authenticated attacker can achieve stored XSS by exploiting improper sanitization of the plant name value while adding or editing a plant.

  Updated 2025-04-16
• CVE-2025-30510: Growatt Cloud portal Insufficient Type Distinction 9.3 Critical

  An attacker can upload an arbitrary file instead of a plant image.

  Updated 2025-04-16
• CVE-2025-30509: Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software 4.8 Medium

  Improper input validation for some Intel QuickAssist Technology software before version 2.6.0 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with an authenticated user combined with a low complexity attack may enable data manipulation. This result may potentially occur via local access when attack requirements are not present without special intern

  Updated 2026-02-26
• CVE-2025-30508: Improper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with 6.8 Medium

  Improper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present with special internal knowledge and r

  Updated 2026-02-10
• CVE-2025-30507: CyberData 011209 SIP Emergency Intercom SQL Injection 6.9 Medium

  CyberData 011209 Intercom could allow an unauthenticated user to gather sensitive information through blind SQL injections.

  Updated 2025-06-10
• CVE-2025-30506: Uncontrolled search path for some Intel Driver and Support Assistant before version 25.2 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged softwar 5.4 Medium

  Uncontrolled search path for some Intel Driver and Support Assistant before version 25.2 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable local code execution. This result may potentially occur via local access when attack requirements are not present without special i

  Updated 2026-02-26
• CVE-2025-30485: UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing mal 6.2 Medium

  UNIX symbolic link (Symlink) following issue exists in FutureNet NXR series, VXR series and WXR series routers. Attaching to the affected product an external storage containing malicious symbolic link files, a logged-in administrative user may obtain and/or destroy internal files.

  Updated 2025-04-03
• CVE-2025-30483: Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local acc 5.5 Medium

  Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0 contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

  Updated 2025-07-15
• CVE-2025-30480: Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged attacker with remote a 6.5 Medium

  Dell PowerProtect Data Manager, versions prior to 19.19, contain(s) an Improper Input Validation vulnerability in PowerProtect Data Manager. A low privileged attacker with remote access could potentially exploit this vulnerability to read arbitrary files.

  Updated 2025-07-30
• CVE-2025-30479: Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system. 8.4 High

  Dell CloudLink, versions prior to 8.2, contain a vulnerability where a privileged user with known password can run command injection to gain control of system.

  Updated 2026-02-26
• CVE-2025-30477: Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileged attacker with remote access could po 4.4 Medium

  Dell PowerScale OneFS, versions prior to 9.11.0.0, contains a use of a broken or risky cryptographic algorithm vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

  Updated 2025-07-21
• CVE-2025-30476: Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could potentially exploit this v 5.3 Medium

  Dell PowerScale InsightIQ, version 5.2, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

  Updated 2025-05-16
• CVE-2025-30475: Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. An unauthenticated attacker with remote access could potentially explo 8.1 High

  Dell PowerScale InsightIQ, versions 5.0 through 5.2, contains an improper privilege management vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.

  Updated 2025-05-16
• CVE-2025-30474: Apache Commons VFS: Failing to find an FTP file can reveal the URI's password in an error message 5.0 Medium

  Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Commons VFS. The FtpFileObject class can throw an exception when a file is not found, revealing the original URI in its message, which may include a password. The fix is to mask the password in the exception message This issue affects Apache Commons VFS: before 2.10.0. Users are recommended to upgrade to version 2

  Updated 2025-04-01
• CVE-2025-30473: Apache Airflow Common SQL Provider: Remote Code Execution via Sql Injection 8.8 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Airflow Common SQL Provider. When using the partition clause in SQLTableCheckOperator as parameter (which was a recommended pattern), Authenticated UI User could inject arbitrary SQL command when triggering DAG exposing partition_clause to the user. This allowed the DAG Triggering user to

  Updated 2026-02-26
• CVE-2025-30472: Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a l 9.0 Critical

  Corosync through 3.1.9, if encryption is disabled or the attacker knows the encryption key, has a stack-based buffer overflow in orf_token_endian_convert in exec/totemsrp.c via a large UDP packet.

  Updated 2025-11-03
• CVE-2025-30471: A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, 7.5 High

  A validation issue was addressed with improved logic. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5, tvOS 18.4, visionOS 2.4, watchOS 11.4. A remote user may be able to cause a denial-of-service.

  Updated 2026-04-02

Search a CVE ID or check dependency files →