CVE-2025-52xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

581 records · Page 2 of 6

• CVE-2025-52880: Komga Vulnerable to Arbitrary Code Execution via Crafted EPUB File 4.2 Medium

  Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through 1.21.3 when serving EPUB resources, either directly from the API, or when reading using the epub reader. The vulnerability lets an attacker perform actions on the victim's behalf. When targeting an admin user, this can be combined with cont

  Updated 2025-06-24
• CVE-2025-52879: In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible 4.8 Medium

  In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible

  Updated 2025-06-24
• CVE-2025-52878: In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions 4.3 Medium

  In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions

  Updated 2025-06-23
• CVE-2025-52877: In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible 4.8 Medium

  In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible

  Updated 2025-06-23
• CVE-2025-52876: In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible 5.4 Medium

  In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible

  Updated 2025-06-23
• CVE-2025-52875: In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible 5.4 Medium

  In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible

  Updated 2025-06-23
• CVE-2025-52873: Cognex In-Sight Explorer and In-Sight Camera Firmware Incorrect Permission Assignment for Critical Resource 7.2 High

  Cognex In-Sight Explorer and In-Sight Camera Firmware expose a telnet-based service on port 23 to allow management operations such as firmware upgrades and device reboots, which require authentication. A user with protected privileges can successfully invoke the SetSystemConfig functionality to modify relevant device properties (such as network settings), contradicting the security model prop

  Updated 2025-09-19
• CVE-2025-52872: QTS, QuTS hero 1.3 Low

  A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 bui

  Updated 2026-01-02
• CVE-2025-52871: License Center 1.3 Low

  An out-of-bounds read vulnerability has been reported to affect License Center. If a remote attacker gains a user account, they can then exploit the vulnerability to obtain secret data. We have already fixed the vulnerability in the following version: License Center 2.0.36 and later

  Updated 2026-01-02
• CVE-2025-52870: Qsync Central 0.6 Low

  A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

  Updated 2026-02-11
• CVE-2025-52869: Qsync Central 0.6 Low

  A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

  Updated 2026-02-11
• CVE-2025-52868: Qsync Central 0.6 Low

  A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.4 ( 2026/01/20 ) and later

  Updated 2026-02-11
• CVE-2025-52867: Qsync Central 6.0 Medium

  An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.2 ( 2025/07/31 ) and later

  Updated 2025-10-03
• CVE-2025-52866: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52865: File Station 5 1.3 Low

  A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following version: File Station 5 5.5.6.5018 and later

  Updated 2025-11-07
• CVE-2025-52864: QTS, QuTS hero 1.3 Low

  A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 bui

  Updated 2026-01-02
• CVE-2025-52863: QTS, QuTS hero 1.3 Low

  A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then exploit the vulnerability to modify memory or crash processes. We have already fixed the vulnerability in the following versions: QTS 5.2.7.3256 build 20250913 and later QuTS hero h5.2.7.3256 build 20250913 and later QuTS hero h5.3.0.3192 bui

  Updated 2026-01-02
• CVE-2025-52862: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52861: VioStor 7.0 High

  A path traversal vulnerability has been reported to affect VioStor. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later

  Updated 2025-08-29
• CVE-2025-52860: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52859: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52858: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52857: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52856: VioStor 9.3 Critical

  An improper authentication vulnerability has been reported to affect VioStor. If a remote attacker, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: VioStor 5.1.6 build 20250621 and later

  Updated 2026-02-26
• CVE-2025-52855: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52854: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52853: QTS, QuTS hero 5.1 Medium

  A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to launch a denial-of-service (DoS) attack. We have already fixed the vulnerability in the following versions: QTS 5.2.6.3195 build 20250715 and later QuTS hero h5.2.6.3195 build 20250715 and later

  Updated 2025-10-03
• CVE-2025-52842: Laundry 2.3.0 - Account Takeover via Reflected XSS 5.1 Medium

  Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Laundry on Linux, MacOS allows Account Takeover. This issue affects Laundry: 2.3.0.

  Updated 2025-07-02
• CVE-2025-52841: Laundry 2.3.0 - Account Takeover via CSRF 8.5 High

  Cross-Site Request Forgery (CSRF) vulnerability in Laundry on Linux, MacOS allows to perform an Account Takeover. This issue affects Laundry: 2.3.0.

  Updated 2025-07-02
• CVE-2025-52837: Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportuni 7.8 High

  Trend Micro Password Manager (Consumer) version 5.8.0.1327 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow an attacker the opportunity to abuse symbolic links and other methods to delete any file/folder and achieve privilege escalation.

  Updated 2026-02-26
• CVE-2025-52836: WordPress The E-Commerce ERP <= 2.1.1.3 - Privilege Escalation Vulnerability 9.8 Critical

  Incorrect Privilege Assignment vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Privilege Escalation.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.

  Updated 2026-04-28
• CVE-2025-52835: WordPress WING WordPress Migrator plugin <= 1.2.0 - Cross Site Request Forgery (CSRF) vulnerability 9.6 Critical

  Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue affects WING WordPress Migrator: from n/a through <= 1.2.0.

  Updated 2026-04-28
• CVE-2025-52834: WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7.

  Updated 2026-04-28
• CVE-2025-52833: WordPress LMS theme <= 9.2 - SQL Injection Vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affects LMS: from n/a through <= 9.2.

  Updated 2026-04-28
• CVE-2025-52832: WordPress NGG Smart Image Search plugin <= 3.4.1 - SQL Injection Vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows SQL Injection.This issue affects NGG Smart Image Search: from n/a through <= 3.4.1.

  Updated 2026-04-28
• CVE-2025-52831: WordPress Video List Manager plugin <= 1.7 - SQL Injection Vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2025-52830: WordPress bSecure – Your Universal Checkout plugin <= 1.7.9 - SQL Injection Vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bSecure – Your Universal Checkout bSecure – Your Universal Checkout bsecure allows Blind SQL Injection.This issue affects bSecure – Your Universal Checkout: from n/a through <= 1.7.9.

  Updated 2026-04-28
• CVE-2025-52829: WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection Vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DirectIQ DirectIQ Email Marketing directiq-wp allows SQL Injection.This issue affects DirectIQ Email Marketing: from n/a through <= 2.0.

  Updated 2026-04-28
• CVE-2025-52828: WordPress Red Art theme <= 3.8 - PHP Object Injection Vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8.

  Updated 2026-05-12
• CVE-2025-52827: WordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in uxper Nuss nuss allows Object Injection.This issue affects Nuss: from n/a through <= 1.3.3.

  Updated 2026-05-12
• CVE-2025-52826: WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.

  Updated 2026-04-28
• CVE-2025-52825: WordPress Real Estate Manager plugin <= 7.3 - Cross Site Request Forgery (CSRF) Vulnerability 8.8 High

  Cross-Site Request Forgery (CSRF) vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows Privilege Escalation.This issue affects Real Estate Manager: from n/a through <= 7.3.

  Updated 2026-04-28
• CVE-2025-52824: WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerability 8.8 High

  Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.

  Updated 2026-05-12
• CVE-2025-52823: WordPress Cube Portfolio Plugin <= 1.16.8 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ovatheme Cube Portfolio cubeportfolio allows SQL Injection.This issue affects Cube Portfolio: from n/a through <= 1.16.8.

  Updated 2026-05-12
• CVE-2025-52822: WordPress WP Roadmap plugin <= 2.1.3 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WP Roadmap wp-roadmap allows SQL Injection.This issue affects WP Roadmap: from n/a through <= 2.1.3.

  Updated 2026-04-28
• CVE-2025-52821: WordPress Video List Manager plugin <= 1.7 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows SQL Injection.This issue affects Video List Manager: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2025-52820: WordPress WooCommerce Point Of Sale (POS) <= 1.4 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in infosoftplugin WooCommerce Point Of Sale (POS) woo-point-of-salepos allows SQL Injection.This issue affects WooCommerce Point Of Sale (POS): from n/a through <= 1.4.

  Updated 2026-04-28
• CVE-2025-52819: WordPress Pakke Envíos plugin <= 1.0.2 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pakkemx Pakke Envíos pakke allows SQL Injection.This issue affects Pakke Envíos: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2025-52818: WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerability 8.2 High

  Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing trusty-whistleblowing-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusty Whistleblowing: from n/a through <= 2.0.1.

  Updated 2026-04-28
• CVE-2025-52817: WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerability 8.2 High

  Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Contact Form 7: from n/a through <= 2.2.

  Updated 2026-04-28
• CVE-2025-52816: WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local File Inclusion.This issue affects Zita: from n/a through <= 1.6.5.

  Updated 2026-05-12
• CVE-2025-52815: WordPress CityGov theme <= 1.9 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CityGov citygov allows PHP Local File Inclusion.This issue affects CityGov: from n/a through <= 1.9.

  Updated 2026-04-28
• CVE-2025-52814: WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local File Inclusion.This issue affects BRW: from n/a through <= 1.8.7.

  Updated 2026-04-28
• CVE-2025-52813: WordPress MobiLoud <= 4.6.5 - Broken Access Control Vulnerability 8.1 High

  Missing Authorization vulnerability in pietro MobiLoud allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MobiLoud: from n/a through 4.6.5.

  Updated 2026-04-28
• CVE-2025-52812: WordPress Domnoo theme <= 1.49 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Domnoo domnoo allows PHP Local File Inclusion.This issue affects Domnoo: from n/a through <= 1.49.

  Updated 2026-04-28
• CVE-2025-52811: WordPress Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Local File Inclusion Vulnerability 8.1 High

  Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This issue affects Davenport - Versatile Blog and Magazine WordPress Theme: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2025-52810: WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion Vulnerability 8.1 High

  Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.

  Updated 2026-04-28
• CVE-2025-52809: WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Russell National Weather Service Alerts national-weather-service-alerts allows PHP Local File Inclusion.This issue affects National Weather Service Alerts: from n/a through <= 1.3.5.

  Updated 2026-05-12
• CVE-2025-52808: WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in real-web RealtyElite realtyelite allows PHP Local File Inclusion.This issue affects RealtyElite: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-52807: WordPress Kossy - Minimalist eCommerce WordPress Theme <= 1.45 - Local File Inclusion Vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce WordPress Theme kossy allows PHP Local File Inclusion.This issue affects Kossy - Minimalist eCommerce WordPress Theme: from n/a through <= 1.45.

  Updated 2026-04-28
• CVE-2025-52806: WordPress JobSearch Plugin < 3.0.8 - Local File Inclusion Vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in eyecix JobSearch wp-jobsearch allows PHP Local File Inclusion.This issue affects JobSearch: from n/a through < 3.0.8.

  Updated 2026-04-28
• CVE-2025-52805: WordPress Leyka plugin <= 3.32.1 - Local File Inclusion vulnerability 7.5 High

  Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1.

  Updated 2026-04-28
• CVE-2025-52804: WordPress Nuss theme <= 1.3.7.1 - Broken Access Control Vulnerability 7.5 High

  Missing Authorization vulnerability in uxper Nuss nuss allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Nuss: from n/a through <= 1.3.7.1.

  Updated 2026-04-28
• CVE-2025-52803: WordPress Sala theme <= 1.1.3 - Broken Access Control Vulnerability 7.5 High

  Missing Authorization vulnerability in uxper Sala allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sala: from n/a through 1.1.3.

  Updated 2026-04-28
• CVE-2025-52802: WordPress Import YouTube videos as WP Posts plugin <= 2.1 - Broken Access Control Vulnerability 7.5 High

  Missing Authorization vulnerability in enguerranws Import YouTube videos as WP Posts import-youtube-videos-as-wp-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Import YouTube videos as WP Posts: from n/a through <= 2.1.

  Updated 2026-04-28
• CVE-2025-52801: WordPress TheBooking Plugin <= 1.4.4 - Broken Access Control Vulnerability 7.3 High

  Missing Authorization vulnerability in VonStroheim TheBooking thebooking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects TheBooking: from n/a through <= 1.4.4.

  Updated 2026-05-12
• CVE-2025-52800: WordPress The E-Commerce ERP <= 2.1.1.3 - Broken Access Control Vulnerability 7.3 High

  Missing Authorization vulnerability in Unity Business Technology Pty Ltd The E-Commerce ERP profitori allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects The E-Commerce ERP: from n/a through <= 2.1.1.3.

  Updated 2026-04-28
• CVE-2025-52799: WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affects LMS: from n/a through <= 9.2.

  Updated 2026-04-28
• CVE-2025-52798: WordPress JobSearch plugin < 3.0.6 - Reflected Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This issue affects JobSearch: from n/a through < 3.0.6.

  Updated 2026-04-28
• CVE-2025-52797: WordPress StoryMap Plugin <= 2.1 - Cross Site Request Forgery (CSRF) Vulnerability 8.2 High

  Cross-Site Request Forgery (CSRF) vulnerability in josepsitjar StoryMap wp-storymap allows SQL Injection.This issue affects StoryMap: from n/a through <= 2.1.

  Updated 2026-04-28
• CVE-2025-52796: WordPress WP-Recall <= 16.26.14 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affects WP-Recall: from n/a through 16.26.14.

  Updated 2026-04-28
• CVE-2025-52795: WordPress WP Front User Submit / Front Editor plugin <= 5.0.6 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in aharonyan WP Front User Submit / Front Editor front-editor allows Cross Site Request Forgery.This issue affects WP Front User Submit / Front Editor: from n/a through <= 5.0.6.

  Updated 2026-04-28
• CVE-2025-52794: WordPress Creative Contact Form plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Creative-Solutions Creative Contact Form sexy-contact-form allows Stored XSS.This issue affects Creative Contact Form: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-52793: WordPress Esselink.nu Settings plugin <= 4.5 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Esselink.nu Esselink.nu Settings esselinknu-settings allows Reflected XSS.This issue affects Esselink.nu Settings: from n/a through <= 4.5.

  Updated 2026-04-28
• CVE-2025-52792: WordPress WP User Stylesheet Switcher plugin <= v2.2.0 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in vgstef WP User Stylesheet Switcher wp-user-stylesheet-switcher allows Stored XSS.This issue affects WP User Stylesheet Switcher: from n/a through <= v2.2.0.

  Updated 2026-05-12
• CVE-2025-52791: WordPress Knowledge Base – Knowledge Base Maker plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in devfelixmoira Knowledge Base – Knowledge Base Maker knowledge-base-maker allows Stored XSS.This issue affects Knowledge Base – Knowledge Base Maker: from n/a through <= 1.1.8.

  Updated 2026-04-28
• CVE-2025-52790: WordPress WP-DownloadCounter plugin <= 1.01 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in r-win WP-DownloadCounter wp-downloadcounter allows Stored XSS.This issue affects WP-DownloadCounter: from n/a through <= 1.01.

  Updated 2026-04-28
• CVE-2025-52789: WordPress Lewe ChordPress plugin <= 4.0.1 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in George Lewe Lewe ChordPress chordpress allows Stored XSS.This issue affects Lewe ChordPress: from n/a through <= 4.0.1.

  Updated 2026-04-28
• CVE-2025-52788: WordPress CaptionPix <= 1.8 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Russell Jamieson CaptionPix captionpix allows Reflected XSS.This issue affects CaptionPix: from n/a through <= 1.8.

  Updated 2026-05-12
• CVE-2025-52787: WordPress Tennis Court Bookings plugin <= 1.2.7 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EZiHosting Tennis Court Bookings tennis-court-bookings allows Reflected XSS.This issue affects Tennis Court Bookings: from n/a through <= 1.2.7.

  Updated 2026-04-28
• CVE-2025-52786: WordPress Media Folder plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kingdom Creation Media Folder media-folder allows Reflected XSS.This issue affects Media Folder: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-52785: WordPress SMM API plugin <= 6.0.31 - Broken Access Control vulnerability 7.1 High

  Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through <= 6.0.31.

  Updated 2026-04-28
• CVE-2025-52784: WordPress Bluff Post plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in hideoguchi Bluff Post bluff-post allows Stored XSS.This issue affects Bluff Post: from n/a through <= 1.1.1.

  Updated 2026-04-28
• CVE-2025-52783: WordPress Change Cart button Colors WooCommerce plugin <= 1.0 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in themelocation Change Cart button Colors WooCommerce wc-style allows Stored XSS.This issue affects Change Cart button Colors WooCommerce: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-52782: WordPress Scroll UP plugin <= 2.0 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in King Rayhan Scroll UP scroll-to-up allows Reflected XSS.This issue affects Scroll UP: from n/a through <= 2.0.

  Updated 2026-04-28
• CVE-2025-52781: WordPress TinyNav plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Beee TinyNav tinynav allows Stored XSS.This issue affects TinyNav: from n/a through <= 1.4.

  Updated 2026-04-28
• CVE-2025-52780: WordPress Logo Manager For Samandehi plugin <= 0.5 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Mohammad Parsa Logo Manager For Samandehi samandehi-logo-manager allows Stored XSS.This issue affects Logo Manager For Samandehi: from n/a through <= 0.5.

  Updated 2026-05-12
• CVE-2025-52779: WordPress Dot html,php,xml etc pages plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in karimmughal Dot html,php,xml etc pages dot-htmlphpxml-etc-pages allows Reflected XSS.This issue affects Dot html,php,xml etc pages: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-52778: WordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary allows Reflected XSS.This issue affects xili-dictionary: from n/a through <= 2.12.5.2.

  Updated 2026-04-28
• CVE-2025-52777: WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmsMinds Pay with Contact Form 7 pay-with-contact-form-7 allows Reflected XSS.This issue affects Pay with Contact Form 7: from n/a through <= 1.0.4.

  Updated 2026-04-28
• CVE-2025-52776: WordPress Video List Manager plugin <= 1.7 - Cross Site Scripting (XSS) Vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows Stored XSS.This issue affects Video List Manager: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2025-52775: WordPress Project Cost Calculator Plugin <= 1.0.0 - Broken Access Control Vulnerability 7.1 High

  Missing Authorization vulnerability in Ronik@UnlimitedWP Project Cost Calculator project-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Project Cost Calculator: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-52774: WordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.15.06.

  Updated 2026-04-28
• CVE-2025-52773: WordPress HieCOR Payment Gateway plugin plugin <= 1.5.11 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in hiecor HieCOR Payment Gateway Plugin hcv4-payment-gateway allows SQL Injection.This issue affects HieCOR Payment Gateway Plugin: from n/a through <= 1.5.11.

  Updated 2026-04-28
• CVE-2025-52772: WordPress Virtual Moderator plugin <= 1.4 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Adnan Haque (a11n) Virtual Moderator allows Cross-Site Scripting (XSS). This issue affects Virtual Moderator: from n/a through 1.4.

  Updated 2026-04-28
• CVE-2025-52771: WordPress Video Expander Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bcupham Video Expander video-expander allows Stored XSS.This issue affects Video Expander: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-52770: WordPress Hello Followers plugin <= 2.5 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in appscreo Hello Followers hellofollowers allows Reflected XSS.This issue affects Hello Followers: from n/a through <= 2.5.

  Updated 2026-04-28
• CVE-2025-52769: WordPress flexo-social-gallery Plugin <= 1.0006 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in flexostudio flexo-social-gallery flexo-social-gallery allows Cross Site Request Forgery.This issue affects flexo-social-gallery: from n/a through <= 1.0006.

  Updated 2026-04-28
• CVE-2025-52768: WordPress Faith & Hope theme <= 2.13.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Faith & Hope faith-hope allows PHP Local File Inclusion.This issue affects Faith & Hope: from n/a through <= 2.13.0.

  Updated 2026-04-28
• CVE-2025-52767: WordPress NetInsight Analytics Implementation Plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in lisensee NetInsight Analytics Implementation Plugin netinsight-analytics-implementation-plugin allows Cross Site Request Forgery.This issue affects NetInsight Analytics Implementation Plugin: from n/a through <= 1.0.3.

  Updated 2026-04-28

Search a CVE ID or check dependency files →