CVE-2025-54xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

904 records · Page 10 of 10

• CVE-2025-54004: WordPress WCFM – Frontend Manager for WooCommerce plugin <= 6.7.24 - Broken Access Control vulnerability 2.7 Low

  Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WCFM – Frontend Manager for WooCommerce: from n/a through <= 6.7.24.

  Updated 2026-04-28
• CVE-2025-54003: WordPress Depot theme <= 1.16 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Depot depot allows PHP Local File Inclusion.This issue affects Depot: from n/a through <= 1.16.

  Updated 2026-04-28
• CVE-2025-54002: WordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart: from n/a through <= 1.2.9.4.

  Updated 2026-04-28
• CVE-2025-54001: WordPress Classter theme <= 2.5 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in ThemeREX Classter classter allows Object Injection.This issue affects Classter: from n/a through <= 2.5.

  Updated 2026-04-28

Search a CVE ID or check dependency files →