CVE-2025-39xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

595 records · Page 5 of 6

• CVE-2025-39533: WordPress Starfish Review Generation & Marketing plugin <= 3.1.19 - Privilege Escalation vulnerability 8.8 High

  Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing starfish-reviews allows Privilege Escalation.This issue affects Starfish Review Generation & Marketing: from n/a through <= 3.1.19.

  Updated 2026-04-28
• CVE-2025-39532: WordPress Spice Blocks plugin <= 2.0.7.7 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spice Blocks: from n/a through <= 2.0.7.7.

  Updated 2026-04-28
• CVE-2025-39531: WordPress Slazzer Background Changer plugin <= 3.14 - Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in slazzercom Slazzer Background Changer slazzer-background-changer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slazzer Background Changer: from n/a through <= 3.14.

  Updated 2026-04-28
• CVE-2025-39530: WordPress Site Search 360 plugin <= 2.1.8 - Cross Site Request Forgery (CSRF) to stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 site-search-360 allows Stored XSS.This issue affects Site Search 360: from n/a through <= 2.1.8.

  Updated 2026-04-28
• CVE-2025-39529: WordPress Scriptless Social Sharing plugin <= 3.3.0 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin Cornett Scriptless Social Sharing scriptless-social-sharing allows Stored XSS.This issue affects Scriptless Social Sharing: from n/a through <= 3.3.0.

  Updated 2026-04-28
• CVE-2025-39528: WordPress Rescue Shortcodes plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes rescue-shortcodes allows Stored XSS.This issue affects Rescue Shortcodes: from n/a through <= 3.1.

  Updated 2026-04-28
• CVE-2025-39527: WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebSoft: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2025-39526: WordPress Hotel Booking Plugin <= 3.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.

  Updated 2026-04-28
• CVE-2025-39525: WordPress Logo Carousel Slider plugin <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Logo Carousel Slider logo-carousel-slider allows Stored XSS.This issue affects Logo Carousel Slider: from n/a through <= 2.1.3.

  Updated 2026-04-28
• CVE-2025-39524: WordPress Html5 Audio Player plugin <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through <= 2.2.28.

  Updated 2026-04-28
• CVE-2025-39523: WordPress GoodBarber plugin <= 1.0.26 - Open Redirection Vulnerability 4.7 Medium

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26.

  Updated 2026-04-28
• CVE-2025-39522: WordPress Dynamic Post plugin <= 5.03 - Settings Change vulnerability 5.4 Medium

  Missing Authorization vulnerability in Service2Client LLC Dynamic Post dynamic-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dynamic Post: from n/a through <= 5.03.

  Updated 2026-04-28
• CVE-2025-39521: WordPress Contact Form vCard Generator plugin <= 2.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vcard-generator allows Reflected XSS.This issue affects Contact Form vCard Generator: from n/a through <= 2.4.

  Updated 2026-04-28
• CVE-2025-39520: WordPress Checkout Files Upload for WooCommerce plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout Files Upload for WooCommerce checkout-files-upload-woocommerce allows Stored XSS.This issue affects Checkout Files Upload for WooCommerce: from n/a through <= 2.2.0.

  Updated 2026-04-28
• CVE-2025-39519: WordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in runthings.dev Bulk Page Stub Creator bulk-page-stub-creator allows Reflected XSS.This issue affects Bulk Page Stub Creator: from n/a through <= 1.1.

  Updated 2026-04-28
• CVE-2025-39518: WordPress BMA Lite plugin <= 1.4.2 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RedefiningTheWeb BMA Lite bma-lite-appointment-booking-and-scheduling allows SQL Injection.This issue affects BMA Lite: from n/a through <= 1.4.2.

  Updated 2026-04-28
• CVE-2025-39517: WordPress Basic Interactive World Map plugin <= 2.7 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Basic Interactive World Map basic-interactive-world-map allows Cross Site Request Forgery.This issue affects Basic Interactive World Map: from n/a through <= 2.7.

  Updated 2026-04-28
• CVE-2025-39516: WordPress Author WIP Progress Bar plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alan Petersen Author WIP Progress Bar author-work-in-progress-bar allows DOM-Based XSS.This issue affects Author WIP Progress Bar: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-39515: WordPress Attendance Manager plugin <= 0.6.2 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tnomi Attendance Manager attendance-manager allows Stored XSS.This issue affects Attendance Manager: from n/a through <= 0.6.2.

  Updated 2026-04-28
• CVE-2025-39514: WordPress Asgaros Forum plugin <= 3.2.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Asgaros Asgaros Forum asgaros-forum allows Stored XSS.This issue affects Asgaros Forum: from n/a through <= 3.2.1.

  Updated 2026-04-28
• CVE-2025-39513: WordPress ActiveDEMAND plugin <= 0.2.46 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ActiveDEMAND Online Agency Marketing Automation ActiveDEMAND activedemand allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects ActiveDEMAND: from n/a through <= 0.2.46.

  Updated 2026-04-28
• CVE-2025-39512: WordPress Bulk Term Editor plugin <= 1.1.4 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Yuya Hoshino Bulk Term Editor bulk-term-editor allows Cross Site Request Forgery.This issue affects Bulk Term Editor: from n/a through <= 1.1.4.

  Updated 2026-04-28
• CVE-2025-39511: WordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control Vulnerability 4.3 Medium

  Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/a through <= 4.19.0.

  Updated 2026-04-28
• CVE-2025-39510: WordPress Pinterest Automatic Pin plugin < 4.19.0 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows SQL Injection.This issue affects Pinterest Automatic Pin: from n/a through < 4.19.0.

  Updated 2026-04-28
• CVE-2025-39509: WordPress TNC FlipBook plugin <= 12.1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows Stored XSS.This issue affects TNC FlipBook: from n/a through <= 12.1.0.

  Updated 2026-04-28
• CVE-2025-39508: WordPress Nasa Core Plugin <= 6.4.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Reflected XSS.This issue affects Nasa Core: from n/a through <= 6.4.4.

  Updated 2026-05-12
• CVE-2025-39507: WordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through < 6.4.4.

  Updated 2026-04-28
• CVE-2025-39506: WordPress Nasa Core Plugin <= 6.3.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through <= 6.3.2.

  Updated 2026-04-28
• CVE-2025-39505: WordPress Goodlayers Hotel plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Reflected XSS.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  Updated 2026-04-28
• CVE-2025-39504: WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  Updated 2026-04-28
• CVE-2025-39503: WordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

  Updated 2026-04-28
• CVE-2025-39502: WordPress Goodlayers Hostel Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Reflected XSS.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

  Updated 2026-04-28
• CVE-2025-39501: WordPress Goodlayers Hostel plugin <= 3.1.4 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Blind SQL Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.4.

  Updated 2026-05-12
• CVE-2025-39500: WordPress Goodlayers Hostel Plugin <= 3.1.2 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

  Updated 2026-04-28
• CVE-2025-39499: WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-39498: WordPress Spotlight - Social Media Feeds (Premium) plugin <= 1.7.1 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Spotlight Spotlight - Social Media Feeds (Premium) allows Retrieve Embedded Sensitive Data.This issue affects Spotlight - Social Media Feeds (Premium): from n/a through 1.7.1.

  Updated 2026-04-28
• CVE-2025-39497: WordPress Dokan Pro plugin <= 3.14.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Dokan Pro: from n/a through 3.14.5.

  Updated 2026-04-28
• CVE-2025-39496: WordPress WooBeWoo Product Filter Pro plugin < 2.9.6 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW WooBeWoo Product Filter Pro allows SQL Injection.This issue affects WooBeWoo Product Filter Pro: from n/a before 2.9.6.

  Updated 2026-04-28
• CVE-2025-39495: WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.

  Updated 2026-04-28
• CVE-2025-39494: WordPress Wilmër theme < 3.4.2 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through < 3.4.2.

  Updated 2026-04-28
• CVE-2025-39493: WordPress Rankie plugin < 1.8.2 - Broken Access Control Vulnerability 4.3 Medium

  Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rankie: from n/a through < 1.8.2.

  Updated 2026-05-12
• CVE-2025-39492: WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability 7.5 High

  Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.

  Updated 2026-04-28
• CVE-2025-39491: WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability 8.1 High

  Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.

  Updated 2026-04-28
• CVE-2025-39490: WordPress Backpack Traveler theme <= 2.10.2 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows PHP Local File Inclusion.This issue affects Backpack Traveler: from n/a through <= 2.10.2.

  Updated 2026-04-28
• CVE-2025-39489: WordPress CouponXL theme <= 4.5.0 - Privilege Escalation Vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0.

  Updated 2026-04-28
• CVE-2025-39488: WordPress MagOne theme <= 8.8 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sneeit MagOne magone allows Reflected XSS.This issue affects MagOne: from n/a through <= 8.8.

  Updated 2026-04-28
• CVE-2025-39487: WordPress Rankie plugin <= 1.8.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie valvepress-rankie allows Reflected XSS.This issue affects Rankie: from n/a through <= 1.8.2.

  Updated 2026-05-12
• CVE-2025-39486: WordPress Rankie plugin < 1.8.2 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Rankie valvepress-rankie allows SQL Injection.This issue affects Rankie: from n/a through < 1.8.2.

  Updated 2026-04-28
• CVE-2025-39485: WordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.

  Updated 2026-04-28
• CVE-2025-39484: WordPress Entrada Theme <= 5.7.7 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects Entrada: from n/a through 5.7.7.

  Updated 2026-04-28
• CVE-2025-39483: WordPress Eventer plugin < 3.9.9.1 - Content Injection vulnerability 6.5 Medium

  Improper Control of Generation of Code ('Code Injection') vulnerability in imithemes Eventer eventer allows Code Injection.This issue affects Eventer: from n/a through < 3.9.9.1.

  Updated 2026-04-28
• CVE-2025-39482: WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.

  Updated 2026-04-28
• CVE-2025-39481: WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through < 3.11.4.

  Updated 2026-04-28
• CVE-2025-39480: WordPress Car Dealer theme < 1.6.8 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.

  Updated 2026-04-28
• CVE-2025-39479: WordPress Smart Notification Plugin <= 10.3 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in smartiolabs Smart Notification allows Blind SQL Injection. This issue affects Smart Notification: from n/a through 10.3.

  Updated 2026-04-28
• CVE-2025-39478: WordPress Smart Notification Plugin <= 10.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in smartiolabs Smart Notification allows Reflected XSS. This issue affects Smart Notification: from n/a through 10.3.

  Updated 2026-04-28
• CVE-2025-39477: WordPress InWave Jobs Plugin <= 3.5.8 - Broken Access Control vulnerability 9.8 Critical

  Missing Authorization vulnerability in Sfwebservice InWave Jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects InWave Jobs: from n/a through 3.5.8.

  Updated 2026-04-28
• CVE-2025-39476: WordPress Revo theme <= 4.0.26 - Local File Inclusion Vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Revo revo allows PHP Local File Inclusion.This issue affects Revo: from n/a through <= 4.0.26.

  Updated 2026-04-28
• CVE-2025-39475: WordPress Arlo theme <= 6.0.3 - Local File Inclusion Vulnerability 8.1 High

  Path Traversal: '.../...//' vulnerability in Frenify Arlo arlo allows PHP Local File Inclusion.This issue affects Arlo: from n/a through <= 6.0.3.

  Updated 2026-04-28
• CVE-2025-39474: WordPress Amely theme <= 3.1.4 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ThemeMove Amely amely allows SQL Injection.This issue affects Amely: from n/a through <= 3.1.4.

  Updated 2026-04-28
• CVE-2025-39473: WordPress Seofy Core plugin <= 1.6.8 - Local File Inclusion Vulnerability 8.1 High

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebGeniusLab Seofy Core seofy-core allows PHP Local File Inclusion.This issue affects Seofy Core: from n/a through <= 1.6.8.

  Updated 2026-04-28
• CVE-2025-39472: WordPress WooCommerce Social Login plugin < 2.8.3 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in wpweb WooCommerce Social Login woo-social-login allows Cross Site Request Forgery.This issue affects WooCommerce Social Login: from n/a through < 2.8.3.

  Updated 2026-05-12
• CVE-2025-39471: WordPress Modal Survey plugin <= 2.0.2.0.1 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1.

  Updated 2026-04-28
• CVE-2025-39470: WordPress Ivy School theme <= 1.6.0 - Local File Inclusion Vulnerability 8.1 High

  Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through <= 1.6.0.

  Updated 2026-04-28
• CVE-2025-39469: WordPress Modal Survey plugin <= 2.0.2.0.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1.

  Updated 2026-04-28
• CVE-2025-39468: WordPress Modal Survey plugin <= 2.0.2.0.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1.

  Updated 2026-04-28
• CVE-2025-39467: WordPress Wanderland theme <= 1.7.1 - Local File Inclusion Vulnerability 8.1 High

  Path Traversal: '.../...//' vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a through <= 1.7.1.

  Updated 2026-04-28
• CVE-2025-39466: WordPress Dør theme <= 2.4 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Dør dor allows PHP Local File Inclusion.This issue affects Dør: from n/a through <= 2.4.

  Updated 2026-04-28
• CVE-2025-39465: WordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Maps: from n/a through <= 5.8.4.

  Updated 2026-04-28
• CVE-2025-39464: WordPress AdminQuickbar plugin <= 1.9.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites AdminQuickbar adminquickbar allows Reflected XSS.This issue affects AdminQuickbar: from n/a through <= 1.9.1.

  Updated 2026-05-12
• CVE-2025-39463: WordPress Dessau theme < 1.9 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Dessau dessau allows PHP Local File Inclusion.This issue affects Dessau: from n/a through < 1.9.

  Updated 2026-04-28
• CVE-2025-39462: WordPress Smart Agreements plugin <= 1.0.3 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in teamzt Smart Agreements smart-agreements allows PHP Local File Inclusion.This issue affects Smart Agreements: from n/a through <= 1.0.3.

  Updated 2026-05-12
• CVE-2025-39461: WordPress Docket Cache plugin <= 24.07.02 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cache allows PHP Local File Inclusion.This issue affects Docket Cache: from n/a through <= 24.07.02.

  Updated 2026-05-12
• CVE-2025-39460: WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma: from n/a through <= 5.6.4.

  Updated 2026-04-28
• CVE-2025-39459: WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability 7.3 High

  Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through <= 3.5.2.

  Updated 2026-04-28
• CVE-2025-39458: WordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through <= 2.5.2.

  Updated 2026-04-28
• CVE-2025-39457: WordPress Booking and Rental Manager plugin <= 2.2.8 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.2.8.

  Updated 2026-04-28
• CVE-2025-39456: WordPress WP Logger plugin <= 2.2 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Logger: from n/a through <= 2.2.

  Updated 2026-04-28
• CVE-2025-39455: WordPress IP2Location Variables plugin <= 2.9.5 - CSRF to Cross Site Scripting (XSS) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location Variables: from n/a through <= 2.9.5.

  Updated 2026-04-28
• CVE-2025-39454: WordPress Name Directory plugin <= 1.30.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.30.0.

  Updated 2026-05-12
• CVE-2025-39453: WordPress Advanced Dynamic Pricing for WooCommerce plugin <= 4.9.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advanced-dynamic-pricing-for-woocommerce allows Cross Site Request Forgery.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a through <= 4.9.3.

  Updated 2026-04-28
• CVE-2025-39452: WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through <= 2.2.32.

  Updated 2026-04-28
• CVE-2025-39451: WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability 7.5 High

  Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.

  Updated 2026-05-12
• CVE-2025-39450: WordPress JetTabs plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.7.

  Updated 2026-04-28
• CVE-2025-39449: WordPress JetWooBuilder plugin <= 2.1.18 - Broken Access Control Vulnerability 7.5 High

  Missing Authorization vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetWooBuilder: from n/a through <= 2.1.18.

  Updated 2026-04-29
• CVE-2025-39448: WordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

  Updated 2026-04-28
• CVE-2025-39447: WordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control Vulnerability 7.5 High

  Missing Authorization vulnerability in Crocoblock JetElements For Elementor jet-elements allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

  Updated 2026-04-29
• CVE-2025-39446: WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4.

  Updated 2026-04-28
• CVE-2025-39445: WordPress Super Store Finder <= 7.2 - SQL Injection Vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.2.

  Updated 2026-04-28
• CVE-2025-39444: WordPress MaxButtons plugin <= 9.8.3 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry MaxButtons maxbuttons allows Stored XSS.This issue affects MaxButtons: from n/a through <= 9.8.3.

  Updated 2026-04-28
• CVE-2025-39443: WordPress Verge3D plugin <= 4.9.0 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.9.0.

  Updated 2026-04-28
• CVE-2025-39442: WordPress Review Wave – Google Places Reviews plugin <= 1.4.7 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in MessageMetric Review Wave – Google Places Reviews review-wave-google-places-reviews allows Stored XSS.This issue affects Review Wave – Google Places Reviews: from n/a through <= 1.4.7.

  Updated 2026-04-28
• CVE-2025-39441: WordPress Dashboard Notepads plugin <= 1.2.1 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in swedish boy Dashboard Notepads dashboard-notepads allows Stored XSS.This issue affects Dashboard Notepads: from n/a through <= 1.2.1.

  Updated 2026-04-28
• CVE-2025-39440: WordPress Broken Links Remover plugin <= 1.2.2 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Broken Links Remover broken-links-remover allows Stored XSS.This issue affects Broken Links Remover: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-39439: WordPress wpLike2Get plugin <= 1.2.9 - Sensitive Data Exposure vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Markus Drubba wpLike2Get wplike2get allows Retrieve Embedded Sensitive Data.This issue affects wpLike2Get: from n/a through <= 1.2.9.

  Updated 2026-04-28
• CVE-2025-39438: WordPress Theme Changer plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in momen2009 Theme Changer theme-changer allows Cross Site Request Forgery.This issue affects Theme Changer: from n/a through <= 1.4.

  Updated 2026-04-28
• CVE-2025-39437: WordPress Anthologize plugin <= 0.8.3 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from n/a through <= 0.8.3.

  Updated 2026-04-28
• CVE-2025-39436: WordPress I Draw <= 1.0 - Arbitrary File Upload Vulnerability 9.1 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in aidraw I Draw idraw allows Using Malicious Files.This issue affects I Draw: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-39435: WordPress My Marginalia plugin <= 1.0.6 - CSRF to Stored XSS vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in davidfcarr My Marginalia my-marginalia allows Stored XSS.This issue affects My Marginalia: from n/a through <= 1.0.6.

  Updated 2026-05-12
• CVE-2025-39434: WordPress Avatar plugin <= 0.1.4 - Insecure Direct Object References (IDOR) vulnerability 4.3 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Scott Taylor Avatar avatar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Avatar: from n/a through <= 0.1.4.

  Updated 2026-04-28

Search a CVE ID or check dependency files →