CVE-2025-58xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

850 records · Page 9 of 9

• CVE-2025-58049: XWiki PDF export jobs store sensitive cookies unencrypted in job statuses 5.8 Medium

  XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki shouldn't store passwords in plain text, and it shouldn't be possible to gain access to plain text passw

  Updated 2025-08-28
• CVE-2025-58048: Paymenter Vulnerable to Remote Code Execution via Public File Uploads 10.0 Critical

  Paymenter is a free and open-source webshop solution for hostings. Prior to version 1.2.11, the ticket attachments functionality in Paymenter allows a malicious authenticated user to upload arbitrary files. This could result in sensitive data extraction from the database, credentials being read from configuration files, and arbitrary system commands being run under the web server user context. Thi

  Updated 2025-08-28
• CVE-2025-58047: Volto affected by possible DoS by invoking specific URL by anonymous user 7.5 High

  Volto is a React based frontend for the Plone Content Management System. In versions from 19.0.0-alpha.1 to before 19.0.0-alpha.4, 18.0.0 to before 18.24.0, 17.0.0 to before 17.22.1, and prior to 16.34.0, an anonymous user could cause the NodeJS server part of Volto to quit with an error when visiting a specific URL. The problem has been patched in versions 16.34.0, 17.22.1, 18.24.0, and 19.0.0-al

  Updated 2025-11-04
• CVE-2025-58046: Dataease has a JDBC attack vulnerability in the Impala datasource 8.7 High

  Dataease is an open-source data visualization and analysis platform. In versions up to and including 2.10.12, the Impala data source is vulnerable to remote code execution due to insufficient filtering in the getJdbc method of the io.dataease.datasource.type.Impala class. Attackers can construct malicious JDBC connection strings that exploit JNDI injection and trigger RMI deserialization, ultimate

  Updated 2025-09-15
• CVE-2025-58045: Dataease server-side request forgery via unfiltered DB2 JDBC ldap parameter 7.1 High

  Dataease is an open source data analytics and visualization platform. In Dataease versions up to 2.10.12, the patch introduced to mitigate DB2 JDBC deserialization remote code execution attacks only blacklisted the rmi parameter. The ldap parameter in the DB2 JDBC connection string was not filtered, allowing attackers to exploit the DB2 JDBC connection string to trigger server-side request forgery

  Updated 2025-09-15
• CVE-2025-58044: JumpServer has an Open Redirect Vulnerability 5.5 Medium

  JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. This vulnerability is fixed in v3.10.19 and v4.10.5.

  Updated 2025-12-01
• CVE-2025-58043: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58042: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58041: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58040: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58039: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58038: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58037: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58036: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58035: Not used Rejected

  Not used

  Updated 2025-08-23 · Rejected record
• CVE-2025-58034: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWe 6.7 Medium

  An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb 7.4.0 through 7.4.10, FortiWeb 7.2.0 through 7.2.11, FortiWeb 7.0.0 through 7.0.11 may allow an authenticated attacker to execute unauthorized code on the underlying system via crafted HTT

  Updated 2026-02-26
• CVE-2025-58033: WordPress Draft Plugin <= 3.0.9 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leeshadle Draft website-builder allows Stored XSS.This issue affects Draft: from n/a through <= 3.0.9.

  Updated 2026-05-12
• CVE-2025-58032: WordPress WP Compiler Plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Bytes.co WP Compiler wp-compiler allows Cross Site Request Forgery.This issue affects WP Compiler: from n/a through <= 1.0.0.

  Updated 2026-04-28
• CVE-2025-58031: WordPress Nextend Facebook Connect Plugin <= 3.1.19 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nextendweb Nextend Facebook Connect nextend-facebook-connect allows Stored XSS.This issue affects Nextend Facebook Connect : from n/a through <= 3.1.19.

  Updated 2026-05-13
• CVE-2025-58030: WordPress Page-list Plugin <= 5.8 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Page-list page-list allows Stored XSS.This issue affects Page-list: from n/a through <= 5.8.

  Updated 2026-05-12
• CVE-2025-58029: WordPress Classic Widgets with Block-based Widgets Plugin <= 1.0.1 - Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in Sumit Singh Classic Widgets with Block-based Widgets classic-widgets-with-block-based-widgets allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Classic Widgets with Block-based Widgets: from n/a through <= 1.0.1.

  Updated 2026-05-13
• CVE-2025-58028: WordPress Designil PDPA Thailand plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aum Watcharapon Designil PDPA Thailand pdpa-thailand allows Stored XSS.This issue affects Designil PDPA Thailand: from n/a through <= 2.0.1.

  Updated 2026-05-13
• CVE-2025-58027: WordPress NGG Smart Image Search Plugin <= 3.4.3 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allows Stored XSS.This issue affects NGG Smart Image Search: from n/a through <= 3.4.3.

  Updated 2026-05-13
• CVE-2025-58026: WordPress Termageddon: Cookie Consent & Privacy Compliance Plugin <= 1.8.1 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in termageddon Termageddon: Cookie Consent & Privacy Compliance termageddon-usercentrics allows Stored XSS.This issue affects Termageddon: Cookie Consent & Privacy Compliance: from n/a through <= 1.8.1.

  Updated 2026-05-13
• CVE-2025-58025: WordPress Master Slider Plugin <= 3.11.0 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in averta Master Slider master-slider allows Stored XSS.This issue affects Master Slider: from n/a through <= 3.11.0.

  Updated 2026-05-13
• CVE-2025-58024: WordPress Accordion FAQ Plugin <= 2.2.1 - Local File Inclusion Vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP Local File Inclusion. This issue affects Accordion FAQ: from n/a through 2.2.1.

  Updated 2026-06-02
• CVE-2025-58023: WordPress Genealogical Tree plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in akdevs Genealogical Tree genealogical-tree allows Stored XSS.This issue affects Genealogical Tree: from n/a through <= 2.2.7.

  Updated 2026-04-28
• CVE-2025-58022: WordPress ShortCode Plugin <= 0.8.1 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxpagels ShortCode shortcode allows Stored XSS.This issue affects ShortCode: from n/a through <= 0.8.1.

  Updated 2026-05-12
• CVE-2025-58021: WordPress List Child Pages Shortcode Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in douglaskarr List Child Pages Shortcode list-child-pages-shortcode allows Stored XSS.This issue affects List Child Pages Shortcode: from n/a through <= 1.3.1.

  Updated 2026-04-28
• CVE-2025-58020: WordPress Theater for WordPress plugin <= 0.18.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.18.8.

  Updated 2026-05-12
• CVE-2025-58019: WordPress Search Atlas SEO Plugin <= 2.5.4 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 2.5.4.

  Updated 2026-05-12
• CVE-2025-58018: WordPress Mail Subscribe List Plugin <= 2.1.10 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman Mail Subscribe List mail-subscribe-list allows Stored XSS.This issue affects Mail Subscribe List: from n/a through <= 2.1.10.

  Updated 2026-05-12
• CVE-2025-58017: WordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.

  Updated 2026-05-13
• CVE-2025-58016: WordPress CF7 Submissions Plugin <= 0.26 - Broken Access Control Vulnerability 4.3 Medium

  Missing Authorization vulnerability in Codexpert, Inc CF7 Submissions cf7-submissions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CF7 Submissions: from n/a through <= 0.26.

  Updated 2026-05-12
• CVE-2025-58015: WordPress Quiz Maker Plugin <= 6.7.0.65 - Sensitive Data Exposure Vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Ays Pro Quiz Maker quiz-maker allows Retrieve Embedded Sensitive Data.This issue affects Quiz Maker: from n/a through <= 6.7.0.65.

  Updated 2026-05-12
• CVE-2025-58014: WordPress Quiz Maker Plugin <= 6.7.0.64 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a through <= 6.7.0.64.

  Updated 2026-04-28
• CVE-2025-58013: WordPress CouponXxL Theme <= 4.5.0 - Cross Site Request Forgery (CSRF) Vulnerability 8.8 High

  Cross-Site Request Forgery (CSRF) vulnerability in pebas CouponXxL couponxxl allows Privilege Escalation.This issue affects CouponXxL: from n/a through <= 4.5.0.

  Updated 2026-04-28
• CVE-2025-58012: WordPress Content Mask plugin <= 1.8.5.3 - Insecure Direct Object References (IDOR) vulnerability 3.8 Low

  Authorization Bypass Through User-Controlled Key vulnerability in Alex Content Mask content-mask allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Content Mask: from n/a through <= 1.8.5.3.

  Updated 2026-04-28
• CVE-2025-58011: WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability 6.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through <= 1.8.5.2.

  Updated 2026-04-28
• CVE-2025-58010: WordPress SV Proven Expert Plugin <= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in straightvisions GmbH SV Proven Expert sv-provenexpert allows Cross Site Request Forgery.This issue affects SV Proven Expert: from n/a through <= 2.0.06.

  Updated 2026-04-28
• CVE-2025-58009: WordPress CP Multi View Event Calendar plugin <= 1.4.35 - Broken Access Control vulnerability 3.8 Low

  Missing Authorization vulnerability in codepeople CP Multi View Event Calendar cp-multi-view-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CP Multi View Event Calendar : from n/a through <= 1.4.35.

  Updated 2026-04-28
• CVE-2025-58008: WordPress Participants Database Plugin <= 2.7.6.3 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants Database: from n/a through <= 2.7.6.3.

  Updated 2026-04-28
• CVE-2025-58007: WordPress Social Pug Plugin <= 1.35.2 - Sensitive Data Exposure Vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Hubbub Lite social-pug allows Retrieve Embedded Sensitive Data.This issue affects Hubbub Lite: from n/a through <= 1.35.2.

  Updated 2026-04-28
• CVE-2025-58006: WordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerability 4.7 Medium

  URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Keap/Infusionsoft gf-infusionsoft allows Phishing.This issue affects WP Gravity Forms Keap/Infusionsoft: from n/a through <= 1.2.6.

  Updated 2026-04-28
• CVE-2025-58005: WordPress DriCub Theme <= 2.9 - Server Side Request Forgery (SSRF) Vulnerability 5.4 Medium

  Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft DriCub dricub-driving-school allows Server Side Request Forgery.This issue affects DriCub: from n/a through <= 2.9.

  Updated 2026-04-28
• CVE-2025-58004: WordPress DriCub Theme <= 2.9 - Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in SmartDataSoft DriCub dricub-driving-school allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DriCub: from n/a through <= 2.9.

  Updated 2026-04-28
• CVE-2025-58003: WordPress Javo Core Plugin <= 3.0.0.266 - Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in javothemes Javo Core javo-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Javo Core: from n/a through <= 3.0.0.266.

  Updated 2026-04-28
• CVE-2025-58002: WordPress GD bbPress Tools Plugin <= 3.5.3 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD bbPress Tools gd-bbpress-tools allows DOM-Based XSS.This issue affects GD bbPress Tools: from n/a through <= 3.5.3.

  Updated 2026-04-28
• CVE-2025-58001: WordPress Compact Archives plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi Compact Archives compact-archives allows Stored XSS.This issue affects Compact Archives: from n/a through <= 4.1.0.

  Updated 2026-04-28
• CVE-2025-58000: WordPress Memberful plugin <= 1.75.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in memberful Memberful - Membership Plugin memberful-wp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Memberful - Membership Plugin: from n/a through <= 1.75.0.

  Updated 2026-04-28

Search a CVE ID or check dependency files →