CVE-2025-60xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

531 records · Page 5 of 6

• CVE-2025-60135: WordPress WeShare Buttons Plugin <= 13.0.0 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stored XSS.This issue affects WeShare Buttons: from n/a through <= 13.0.0.

  Updated 2026-04-28
• CVE-2025-60134: WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-60133: WordPress PE Easy Slider Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DJ-Extensions.com PE Easy Slider pe-easy-slider allows Stored XSS.This issue affects PE Easy Slider: from n/a through <= 1.1.0.

  Updated 2026-04-28
• CVE-2025-60132: WordPress Video Blogster Lite Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.

  Updated 2026-04-28
• CVE-2025-60131: WordPress Werk aan de Muur Plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS.This issue affects Werk aan de Muur: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2025-60130: WordPress WEDOS Global Plugin <= 1.2.2 - Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-60129: WordPress Yext Plugin <= 1.1.3 - Broken Access Control Vulnerability 5.3 Medium

  Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through <= 1.1.3.

  Updated 2026-04-28
• CVE-2025-60128: WordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability 4.3 Medium

  Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through <= 1.1.3.

  Updated 2026-04-28
• CVE-2025-60127: WordPress CopySafe Web Protection plugin <= 5.1 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CopySafe Web Protection: from n/a through <= 5.1.

  Updated 2026-04-28
• CVE-2025-60126: WordPress Testimonial Slider Plugin <= 3.5.8.6 - Local File Inclusion Vulnerability 8.8 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through <= 3.5.8.6.

  Updated 2026-04-28
• CVE-2025-60125: WordPress FoodBook Plugin <= 4.7.6 - Sensitive Data Exposure Vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects FoodBook: from n/a through <= 4.7.6.

  Updated 2026-04-28
• CVE-2025-60124: WordPress Simple Colorbox Plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Stored XSS.This issue affects Simple Colorbox: from n/a through <= 1.6.1.

  Updated 2026-04-28
• CVE-2025-60123: WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.

  Updated 2026-04-28
• CVE-2025-60122: WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.

  Updated 2026-04-28
• CVE-2025-60121: WordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.

  Updated 2026-04-28
• CVE-2025-60120: WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.

  Updated 2026-04-28
• CVE-2025-60119: WordPress CoSchedule Plugin <= 3.3.11 - Sensitive Data Exposure Vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.

  Updated 2026-04-28
• CVE-2025-60118: WordPress PGS Core Plugin <= 5.9.0 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Potenzaglobalsolutions PGS Core pgs-core allows SQL Injection.This issue affects PGS Core: from n/a through <= 5.9.0.

  Updated 2026-04-28
• CVE-2025-60117: WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.

  Updated 2026-04-28
• CVE-2025-60116: WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a through < 2.6.4.

  Updated 2026-04-28
• CVE-2025-60115: WordPress Instapage plugin plugin <= 3.7.0 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.This issue affects Instapage Plugin: from n/a through <= 3.7.0.

  Updated 2026-04-28
• CVE-2025-60114: WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability 6.6 Medium

  Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.

  Updated 2026-04-28
• CVE-2025-60113: WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through <= 1.4.3.

  Updated 2026-04-28
• CVE-2025-60112: WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a through <= 1.1.2.

  Updated 2026-04-28
• CVE-2025-60111: WordPress Javo Core Plugin <= 3.0.0.266 - Cross Site Request Forgery (CSRF) Vulnerability 8.8 High

  Cross-Site Request Forgery (CSRF) vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through <= 3.0.0.266.

  Updated 2026-04-28
• CVE-2025-60110: WordPress AllInOne - Banner Rotator Plugin <= 3.8 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup AllInOne - Banner Rotator all-in-one-bannerRotator allows SQL Injection.This issue affects AllInOne - Banner Rotator: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2025-60109: WordPress LambertGroup - AllInOne - Content Slider Plugin <= 3.8 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Content Slider all-in-one-contentSlider allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Content Slider: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2025-60108: WordPress LambertGroup - AllInOne - Banner with Thumbnails Plugin <= 3.8 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Thumbnails all-in-one-thumbnailsBanner allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Thumbnails: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2025-60107: WordPress LambertGroup - AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection Vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LambertGroup - AllInOne - Banner with Playlist all-in-one-bannerWithPlaylist allows Blind SQL Injection.This issue affects LambertGroup - AllInOne - Banner with Playlist: from n/a through <= 3.8.

  Updated 2026-04-28
• CVE-2025-60106: WordPress EmailKit Plugin <= 1.6.0 - Arbitrary Content Deletion Vulnerability 4.9 Medium

  Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmailKit: from n/a through <= 1.6.0.

  Updated 2026-04-28
• CVE-2025-60105: WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.

  Updated 2026-04-28
• CVE-2025-60104: WordPress Gallery Custom Links Plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.

  Updated 2026-04-28
• CVE-2025-60103: WordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.8.

  Updated 2026-04-28
• CVE-2025-60102: WordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.

  Updated 2026-04-28
• CVE-2025-60101: WordPress Woostify Theme <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in duongancol Woostify woostify allows Stored XSS.This issue affects Woostify: from n/a through <= 2.4.2.

  Updated 2026-04-28
• CVE-2025-60100: WordPress XStore theme < 9.6 - Content Injection vulnerability 5.3 Medium

  Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

  Updated 2026-04-28
• CVE-2025-60099: WordPress Embed Any Document Plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Embed Any Document embed-any-document allows Stored XSS.This issue affects Embed Any Document: from n/a through <= 2.7.7.

  Updated 2026-04-28
• CVE-2025-60098: WordPress Theme My Login Plugin <= 7.1.12 - Broken Access Control Vulnerability 6.5 Medium

  Missing Authorization vulnerability in Jeff Farthing Theme My Login theme-my-login allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Theme My Login: from n/a through <= 7.1.12.

  Updated 2026-04-28
• CVE-2025-60097: WordPress TheGem Theme <= 5.10.5 - Broken Access Control Vulnerability 5.4 Medium

  Missing Authorization vulnerability in CodexThemes TheGem thegem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem: from n/a through <= 5.10.5.

  Updated 2026-04-28
• CVE-2025-60096: WordPress TheGem (Elementor) Theme <= 5.10.5 - Broken Access Control Vulnerability 5.4 Medium

  Missing Authorization vulnerability in CodexThemes TheGem (Elementor) thegem-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.

  Updated 2026-04-28
• CVE-2025-60095: WordPress Stackable Plugin <= 3.18.1 - Sensitive Data Exposure Vulnerability 4.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Retrieve Embedded Sensitive Data.This issue affects Stackable: from n/a through <= 3.18.1.

  Updated 2026-04-28
• CVE-2025-60094: WordPress Stackable Plugin <= 3.18.1 - Broken Access Control Vulnerability 4.3 Medium

  Missing Authorization vulnerability in Benjamin Intal Stackable stackable-ultimate-gutenberg-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stackable: from n/a through <= 3.18.1.

  Updated 2026-04-28
• CVE-2025-60093: WordPress Download Manager Plugin <= 3.3.24 - Cross Site Request Forgery (CSRF) Vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Shahjada Download Manager download-manager allows Cross Site Request Forgery.This issue affects Download Manager: from n/a through <= 3.3.24.

  Updated 2026-04-28
• CVE-2025-60092: WordPress Download Manager Plugin <= 3.3.25 - Sensitive Data Exposure Vulnerability 5.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Shahjada Download Manager download-manager allows Retrieve Embedded Sensitive Data.This issue affects Download Manager: from n/a through <= 3.3.25.

  Updated 2026-04-28
• CVE-2025-60091: WordPress WP Gravity Forms Zoho CRM and Bigin plugin <= 1.2.9 - Deserialization of untrusted data vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Zoho CRM and Bigin gf-zoho allows Object Injection.This issue affects WP Gravity Forms Zoho CRM and Bigin: from n/a through <= 1.2.9.

  Updated 2026-04-28
• CVE-2025-60090: WordPress WP Gravity Forms Insightly plugin <= 1.1.6 - Deserialization of untrusted data vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms Insightly gf-insightly allows Object Injection.This issue affects WP Gravity Forms Insightly: from n/a through <= 1.1.6.

  Updated 2026-04-28
• CVE-2025-60089: WordPress WP Gravity Forms FreshDesk plugin plugin <= 1.3.5 - Deserialization of untrusted data vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Object Injection.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.

  Updated 2026-04-28
• CVE-2025-60088: WordPress WebinarIgnition plugin <= 4.06.04 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Saleswonder Team: Tobias WebinarIgnition webinar-ignition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebinarIgnition: from n/a through <= 4.06.04.

  Updated 2026-04-28
• CVE-2025-60087: WordPress Extensive VC Addons for WPBakery page builder plugin <= 1.9.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nenad Obradovic Extensive VC Addons for WPBakery page builder extensive-vc-addon allows PHP Local File Inclusion.This issue affects Extensive VC Addons for WPBakery page builder: from n/a through <= 1.9.1.

  Updated 2026-04-28
• CVE-2025-60086: WordPress WP Voting Contest plugin <= 5.8 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Matt WP Voting Contest wp-voting-contest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Voting Contest: from n/a through <= 5.8.

  Updated 2026-04-28
• CVE-2025-60085: WordPress Learnify theme <= 1.15.0 - Local File Inclusion vulnerability 8.1 High

  Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.

  Updated 2026-06-17
• CVE-2025-60084: WordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Object Injection.This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.

  Updated 2026-04-28
• CVE-2025-60083: WordPress PDF Invoice Builder for WooCommerce plugin <= 6.5.0 - Deserialization of untrusted data vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-woocommerce allows Object Injection.This issue affects PDF Invoice Builder for WooCommerce: from n/a through <= 6.5.0.

  Updated 2026-04-28
• CVE-2025-60082: WordPress PDF for WPForms plugin <= 6.5.0 - Deserialization of untrusted data vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Object Injection.This issue affects PDF for WPForms: from n/a through <= 6.5.0.

  Updated 2026-04-28
• CVE-2025-60081: WordPress PDF for Contact Form 7 plugin <= 6.5.0 - Deserialization of untrusted data vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Object Injection.This issue affects PDF for Contact Form 7: from n/a through <= 6.5.0.

  Updated 2026-04-28
• CVE-2025-60080: WordPress PDF for Gravity Forms + Drag And Drop Template Builder plugin <= 6.5.0 - PHP Object Injection vulnerability 7.5 High

  Deserialization of Untrusted Data vulnerability in add-ons.org PDF for Gravity Forms + Drag And Drop Template Builder pdf-for-gravity-forms allows Object Injection.This issue affects PDF for Gravity Forms + Drag And Drop Template Builder: from n/a through <= 6.5.0.

  Updated 2026-04-28
• CVE-2025-60079: WordPress Parallax Section block plugin <= 1.0.9 - Broken Authentication vulnerability 7.1 High

  Missing Authorization vulnerability in bPlugins Parallax Section block parallax-section allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Parallax Section block: from n/a through <= 1.0.9.

  Updated 2026-04-28
• CVE-2025-60078: WordPress Task Manager plugin <= 3.0.2 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia – Montpellier Task Manager task-manager allows PHP Local File Inclusion.This issue affects Task Manager: from n/a through <= 3.0.2.

  Updated 2026-04-28
• CVE-2025-60077: WordPress YayPricing plugin <= 3.5.3 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in YayCommerce YayPricing yaypricing allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects YayPricing: from n/a through <= 3.5.3.

  Updated 2026-04-28
• CVE-2025-60076: WordPress Ray Enterprise Translation plugin <= 1.7.1 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows PHP Local File Inclusion.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.1.

  Updated 2026-04-28
• CVE-2025-60075: WordPress hpb seo plugin for WordPress plugin <= 3.0.1 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in Allegro Marketing hpb seo plugin for WordPress hpbseo allows Reflected XSS.This issue affects hpb seo plugin for WordPress: from n/a through <= 3.0.1.

  Updated 2026-04-28
• CVE-2025-60074: WordPress Lazy Load Optimizer plugin <= 1.4.7 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Lazy Load Optimizer lazy-load-optimizer allows PHP Local File Inclusion.This issue affects Lazy Load Optimizer: from n/a through <= 1.4.7.

  Updated 2026-04-28
• CVE-2025-60073: WordPress Responsive Sidebar plugin <= 1.2.2 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Responsive Sidebar responsive-sidebar allows PHP Local File Inclusion.This issue affects Responsive Sidebar: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-60072: WordPress Anchor smooth scroll plugin <= 1.0.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Anchor smooth scroll anchor-smooth-scroll allows PHP Local File Inclusion.This issue affects Anchor smooth scroll: from n/a through <= 1.0.2.

  Updated 2026-04-28
• CVE-2025-60071: WordPress Riode | Multi-Purpose WooCommerce theme <= 1.6.23 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in don-themes Riode riode allows PHP Local File Inclusion.This issue affects Riode: from n/a through <= 1.6.23.

  Updated 2026-04-28
• CVE-2025-60070: WordPress Molla - Multipurpose Responsive Shopify theme <= 1.5.13 - Arbitrary Code Execution vulnerability 6.5 Medium

  Improper Control of Generation of Code ('Code Injection') vulnerability in The4 Molla molla allows Code Injection.This issue affects Molla: from n/a through <= 1.5.13.

  Updated 2026-04-28
• CVE-2025-60069: WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

  Updated 2026-04-28
• CVE-2025-60068: WordPress Javo Core plugin <= 3.0.0.266 - Arbitrary Code Execution vulnerability 6.5 Medium

  Improper Control of Generation of Code ('Code Injection') vulnerability in javothemes Javo Core javo-core allows Code Injection.This issue affects Javo Core: from n/a through <= 3.0.0.266.

  Updated 2026-04-28
• CVE-2025-60067: WordPress Giardino theme <= 1.1.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Giardino giardino allows PHP Local File Inclusion.This issue affects Giardino: from n/a through <= 1.1.10.

  Updated 2026-04-28
• CVE-2025-60066: WordPress Katelyn theme <= 1.0.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Katelyn katelyn allows PHP Local File Inclusion.This issue affects Katelyn: from n/a through <= 1.0.10.

  Updated 2026-04-28
• CVE-2025-60065: WordPress Pinevale theme <= 1.0.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pinevale pinevale allows PHP Local File Inclusion.This issue affects Pinevale: from n/a through <= 1.0.14.

  Updated 2026-04-28
• CVE-2025-60064: WordPress Renewal theme <= 1.2.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Renewal renewal allows PHP Local File Inclusion.This issue affects Renewal: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-60063: WordPress Rosalinda theme <= 1.2.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Rosalinda rosalinda allows PHP Local File Inclusion.This issue affects Rosalinda: from n/a through <= 1.2.3.

  Updated 2026-04-28
• CVE-2025-60062: WordPress tPlayer plugin <= 1.2.1.6 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mmetrodw tPlayer tplayer-html5-audio-player-with-playlist allows SQL Injection.This issue affects tPlayer: from n/a through <= 1.2.1.6.

  Updated 2026-04-28
• CVE-2025-60061: WordPress Kicker theme <= 2.2.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Kicker kicker allows PHP Local File Inclusion.This issue affects Kicker: from n/a through <= 2.2.0.

  Updated 2026-04-28
• CVE-2025-60060: WordPress Pubzinne theme <= 1.0.12 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pubzinne pubzinne allows PHP Local File Inclusion.This issue affects Pubzinne: from n/a through <= 1.0.12.

  Updated 2026-04-28
• CVE-2025-60059: WordPress smart SEO theme <= 2.12 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes smart SEO smartSEO allows PHP Local File Inclusion.This issue affects smart SEO: from n/a through <= 2.12.

  Updated 2026-04-28
• CVE-2025-60058: WordPress DetailX theme <= 1.10.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DetailX detailx allows PHP Local File Inclusion.This issue affects DetailX: from n/a through <= 1.10.0.

  Updated 2026-04-28
• CVE-2025-60057: WordPress DJ Rainflow theme <= 1.3.13 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes DJ Rainflow dj-rainflow allows PHP Local File Inclusion.This issue affects DJ Rainflow: from n/a through <= 1.3.13.

  Updated 2026-04-28
• CVE-2025-60056: WordPress Winger theme <= 1.0.16 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Winger winger allows PHP Local File Inclusion.This issue affects Winger: from n/a through <= 1.0.16.

  Updated 2026-04-28
• CVE-2025-60055: WordPress Fabrica theme <= 1.8.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Fabrica fabrica allows PHP Local File Inclusion.This issue affects Fabrica: from n/a through <= 1.8.1.

  Updated 2026-04-28
• CVE-2025-60054: WordPress OnLeash theme <= 1.5.2 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes OnLeash onleash allows PHP Local File Inclusion.This issue affects OnLeash: from n/a through <= 1.5.2.

  Updated 2026-04-28
• CVE-2025-60053: WordPress MaxCube theme <= 1.3.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes MaxCube maxcube allows PHP Local File Inclusion.This issue affects MaxCube: from n/a through <= 1.3.1.

  Updated 2026-04-28
• CVE-2025-60052: WordPress W&D theme <= 1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes W&D wd allows PHP Local File Inclusion.This issue affects W&D: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-60051: WordPress Rare Radio theme <= 1.0.15.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Rare Radio rareradio allows PHP Local File Inclusion.This issue affects Rare Radio: from n/a through <= 1.0.15.1.

  Updated 2026-04-28
• CVE-2025-60050: WordPress Panda theme <= 1.21 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Panda panda allows PHP Local File Inclusion.This issue affects Panda: from n/a through <= 1.21.

  Updated 2026-04-28
• CVE-2025-60049: WordPress Soleil theme <= 1.17 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Soleil soleil allows PHP Local File Inclusion.This issue affects Soleil: from n/a through <= 1.17.

  Updated 2026-04-28
• CVE-2025-60048: WordPress Tripster theme <= 1.0.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Tripster tripster allows PHP Local File Inclusion.This issue affects Tripster: from n/a through <= 1.0.10.

  Updated 2026-04-28
• CVE-2025-60047: WordPress IPharm theme <= 1.2.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes IPharm ipharm allows PHP Local File Inclusion.This issue affects IPharm: from n/a through <= 1.2.3.

  Updated 2026-04-28
• CVE-2025-60046: WordPress HeartStar theme <= 1.0.14 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes HeartStar heartstar allows PHP Local File Inclusion.This issue affects HeartStar: from n/a through <= 1.0.14.

  Updated 2026-04-28
• CVE-2025-60045: WordPress IDonatePro plugin <= 2.1.11 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in ThemeAtelier IDonatePro idonate-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects IDonatePro: from n/a through <= 2.1.11.

  Updated 2026-04-28
• CVE-2025-60044: WordPress Fribbo theme <= 1.1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Fribbo fribbo allows PHP Local File Inclusion.This issue affects Fribbo: from n/a through <= 1.1.0.

  Updated 2026-04-28
• CVE-2025-60043: WordPress Wanderic theme <= 1.0.10 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Wanderic wanderic allows PHP Local File Inclusion.This issue affects Wanderic: from n/a through <= 1.0.10.

  Updated 2026-04-28
• CVE-2025-60042: WordPress Chinchilla theme <= 1.16 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Chinchilla chinchilla allows PHP Local File Inclusion.This issue affects Chinchilla: from n/a through <= 1.16.

  Updated 2026-04-28
• CVE-2025-60041: WordPress Emails Catch All plugin <= 3.5.3 - Broken Authentication vulnerability 8.8 High

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Iulia Cazan Emails Catch All emails-catch-all allows Password Recovery Exploitation.This issue affects Emails Catch All: from n/a through <= 3.5.3.

  Updated 2026-04-28
• CVE-2025-60040: WordPress wp-mpdf Plugin <= 3.9.1 - Cross Site Scripting (XSS) Vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fkrauthan wp-mpdf wp-mpdf allows Stored XSS.This issue affects wp-mpdf: from n/a through <= 3.9.1.

  Updated 2026-05-13
• CVE-2025-60039: WordPress Noisa theme <= 2.6.0 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.

  Updated 2026-04-28
• CVE-2025-60038: A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing mali 7.8 High

  A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). Thi

  Updated 2026-02-18
• CVE-2025-60037: A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing mali 7.8 High

  A vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes the application to deserialize the malicious data, enabling Remote Code Execution (RCE). Thi

  Updated 2026-02-18
• CVE-2025-60036: A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to 7.8 High

  A vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth IndraWorks. All versions prior to 15V24 are affected. This flaw allows an attacker to execute arbitrary code on the user's system by parsing a manipulated file containing malicious serialized data. Exploitation requires user interaction, specifically opening a specially crafted file, which then causes th

  Updated 2026-02-18

Search a CVE ID or check dependency files →