CVE-2025-62xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

876 records · Page 9 of 9

• CVE-2025-62075: WordPress Simple Payment plugin <= 2.4.6 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.

  Updated 2026-04-28
• CVE-2025-62074: WordPress WPMobile.App plugin <= 11.71 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amauri WPMobile.App wpappninja.This issue affects WPMobile.App: from n/a through <= 11.71.

  Updated 2026-04-28
• CVE-2025-62073: WordPress MeetingHub plugin <= 1.23.9 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Sovlix MeetingHub meetinghub.This issue affects MeetingHub: from n/a through <= 1.23.9.

  Updated 2026-04-28
• CVE-2025-62072: WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33.

  Updated 2026-04-28
• CVE-2025-62071: WordPress Social proof testimonials and reviews by Repuso plugin <= 5.29 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29.

  Updated 2026-04-28
• CVE-2025-62070: WordPress WowRevenue plugin <= 1.2.13 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13.

  Updated 2026-04-28
• CVE-2025-62069: WordPress MDTF plugin <= 1.3.3.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 MDTF wp-meta-data-filter-and-taxonomy-filter.This issue affects MDTF: from n/a through <= 1.3.3.8.

  Updated 2026-04-28
• CVE-2025-62068: WordPress e2pdf plugin <= 1.28.09 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf e2pdf e2pdf.This issue affects e2pdf: from n/a through <= 1.28.09.

  Updated 2026-04-28
• CVE-2025-62067: WordPress Savory theme <= 2.5 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Savory savory.This issue affects Savory: from n/a through <= 2.5.

  Updated 2026-04-28
• CVE-2025-62066: WordPress Revolution theme < 2.5.8 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Revolution revolution.This issue affects Revolution: from n/a through < 2.5.8.

  Updated 2026-04-28
• CVE-2025-62065: WordPress RTMKit plugin <= 1.6.5 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.6.5.

  Updated 2026-04-28
• CVE-2025-62064: WordPress Search & Go theme <= 2.7 - Broken Authentication vulnerability 9.8 Critical

  Authentication Bypass Using an Alternate Path or Channel vulnerability in Elated-Themes Search & Go search-and-go allows Password Recovery Exploitation.This issue affects Search & Go: from n/a through <= 2.7.

  Updated 2026-04-28
• CVE-2025-62063: WordPress WP Travel Gutenberg Blocks plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks.This issue affects WP Travel Gutenberg Blocks: from n/a through <= 3.9.2.

  Updated 2026-04-28
• CVE-2025-62062: WordPress Easy Post Submission plugin <= 1.7.0 - Sensitive Data Exposure vulnerability 5.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in ThemeRuby Easy Post Submission easy-post-submission allows Retrieve Embedded Sensitive Data.This issue affects Easy Post Submission: from n/a through <= 1.7.0.

  Updated 2026-04-28
• CVE-2025-62061: WordPress Product Catalog Simple plugin <= 1.8.4 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in impleCode Product Catalog Simple post-type-x.This issue affects Product Catalog Simple: from n/a through <= 1.8.4.

  Updated 2026-04-28
• CVE-2025-62060: WordPress Tab Ultimate plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Tab Ultimate tabs-pro.This issue affects Tab Ultimate: from n/a through <= 1.8.

  Updated 2026-04-28
• CVE-2025-62059: WordPress SureRank plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureRank surerank.This issue affects SureRank: from n/a through <= 1.3.2.

  Updated 2026-04-28
• CVE-2025-62058: WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

  Updated 2026-04-28
• CVE-2025-62057: WordPress Houzez Theme - Functionality plugin < 4.2.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through < 4.2.0.

  Updated 2026-04-28
• CVE-2025-62056: WordPress News Event theme <= 1.0.1 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes News Event news-event.This issue affects News Event: from n/a through <= 1.0.1.

  Updated 2026-04-28
• CVE-2025-62055: WordPress Academist theme < 1.3 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist academist.This issue affects Academist: from n/a through < 1.3.

  Updated 2026-04-28
• CVE-2025-62054: WordPress Houzez Theme - Functionality plugin <= 4.1.8 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality.This issue affects Houzez Theme - Functionality: from n/a through <= 4.1.8.

  Updated 2026-04-28
• CVE-2025-62053: WordPress Houzez theme < 4.2.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through < 4.2.0.

  Updated 2026-04-28
• CVE-2025-62052: WordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.

  Updated 2026-04-28
• CVE-2025-62051: WordPress UDesign Core plugin <= 4.14.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AndonDesign UDesign Core u-design-core.This issue affects UDesign Core: from n/a through <= 4.14.1.

  Updated 2026-04-28
• CVE-2025-62050: WordPress Blogmatic theme <= 1.0.3 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in blazethemes Blogmatic blogmatic.This issue affects Blogmatic: from n/a through <= 1.0.3.

  Updated 2026-04-28
• CVE-2025-62049: WordPress Cost Calculator Builder plugin <= 3.5.32 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder.This issue affects Cost Calculator Builder: from n/a through <= 3.5.32.

  Updated 2026-04-28
• CVE-2025-62048: WordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through <= 3.14.3.

  Updated 2026-04-28
• CVE-2025-62047: WordPress Case Addons plugin < 1.3.0 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in Case-Themes Case Addons case-addons.This issue affects Case Addons: from n/a through < 1.3.0.

  Updated 2026-04-28
• CVE-2025-62046: WordPress TheGem Demo Import (for WPBakery) plugin <= 5.10.5 - Arbitrary Content Deletion vulnerability 6.5 Medium

  Missing Authorization vulnerability in CodexThemes TheGem Demo Import (for WPBakery) thegem-importer.This issue affects TheGem Demo Import (for WPBakery): from n/a through <= 5.10.5.

  Updated 2026-04-28
• CVE-2025-62045: WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.

  Updated 2026-04-28
• CVE-2025-62044: WordPress TheGem Theme Elements (for WPBakery) plugin <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem Theme Elements (for WPBakery) thegem-elements.This issue affects TheGem Theme Elements (for WPBakery): from n/a through <= 5.10.5.1.

  Updated 2026-04-28
• CVE-2025-62043: WordPress WPCasa plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPSight WPCasa allows DOM-Based XSS.This issue affects WPCasa: from n/a through 1.4.1.

  Updated 2026-04-28
• CVE-2025-62042: WordPress Event post plugin <= 5.10.3 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.10.3.

  Updated 2026-04-28
• CVE-2025-62041: WordPress TheGem (Elementor) theme <= 5.10.5.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.1.

  Updated 2026-04-28
• CVE-2025-62040: WordPress YOP Poll plugin <= 6.5.37 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YOP YOP Poll yop-poll.This issue affects YOP Poll: from n/a through <= 6.5.37.

  Updated 2026-04-28
• CVE-2025-62039: WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in Ays Pro AI ChatBot with ChatGPT and Content Generator by AYS ays-chatgpt-assistant allows Retrieve Embedded Sensitive Data.This issue affects AI ChatBot with ChatGPT and Content Generator by AYS: from n/a through <= 2.6.6.

  Updated 2026-04-28
• CVE-2025-62038: WordPress MeetingHub plugin <= 1.23.9 - Sensitive Data Exposure vulnerability 6.5 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Sovlix MeetingHub meetinghub allows Retrieve Embedded Sensitive Data.This issue affects MeetingHub: from n/a through <= 1.23.9.

  Updated 2026-04-28
• CVE-2025-62037: WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.

  Updated 2026-04-28
• CVE-2025-62036: WordPress Togo theme < 1.0.4 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.

  Updated 2026-04-28
• CVE-2025-62035: WordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.

  Updated 2026-04-28
• CVE-2025-62034: WordPress Togo theme < 1.0.4 - Privilege Escalation vulnerability 8.8 High

  Incorrect Privilege Assignment vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.

  Updated 2026-04-28
• CVE-2025-62033: WordPress Togo theme < 1.0.4 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.

  Updated 2026-04-28
• CVE-2025-62032: WordPress tagDiv Cloud Library plugin < 3.9.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Cloud Library td-cloud-library allows DOM-Based XSS.This issue affects tagDiv Cloud Library: from n/a through < 3.9.2.

  Updated 2026-04-28
• CVE-2025-62031: WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.

  Updated 2026-04-28
• CVE-2025-62030: WordPress tagDiv Composer plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tagDiv tagDiv Composer td-composer.This issue affects tagDiv Composer: from n/a through <= 5.4.1.

  Updated 2026-04-28
• CVE-2025-62029: WordPress Grevo theme <= 2.4 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themesion Grevo grevo.This issue affects Grevo: from n/a through <= 2.4.

  Updated 2026-04-28
• CVE-2025-62028: WordPress Salient theme < 17.4.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through < 17.4.0.

  Updated 2026-04-28
• CVE-2025-62027: WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3.

  Updated 2026-04-28
• CVE-2025-62026: WordPress Blockspare plugin <= 3.2.13.2 - Sensitive Data Exposure vulnerability 4.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects Blockspare: from n/a through <= 3.2.13.2.

  Updated 2026-04-28
• CVE-2025-62025: WordPress JobSearch plugin < 3.0.8 - PHP Object Injection vulnerability 9.8 Critical

  Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch.This issue affects JobSearch: from n/a through < 3.0.8.

  Updated 2026-04-28
• CVE-2025-62024: WordPress Pie Calendar plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue affects Pie Calendar: from n/a through <= 1.2.9.

  Updated 2026-04-28
• CVE-2025-62023: WordPress s2Member plugin <= 250905 - Remote Code Execution (RCE) vulnerability 9.0 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in Cristián Lávaque s2Member s2member.This issue affects s2Member: from n/a through 250905.

  Updated 2026-09-29
• CVE-2025-62022: WordPress BuddyPress plugin <= 14.3.4 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4.

  Updated 2026-04-28
• CVE-2025-62021: WordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through <= 1.1.3.

  Updated 2026-04-28
• CVE-2025-62020: WordPress VOD Infomaniak plugin <= 1.5.11 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak.This issue affects VOD Infomaniak: from n/a through <= 1.5.11.

  Updated 2026-04-28
• CVE-2025-62019: WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.

  Updated 2026-04-28
• CVE-2025-62018: WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

  Updated 2026-04-28
• CVE-2025-62017: WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

  Updated 2026-04-28
• CVE-2025-62016: WordPress Kallyas theme <= 4.22.0 - Arbitrary File Upload vulnerability 9.9 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

  Updated 2026-04-28
• CVE-2025-62015: WordPress Advanced Coupons for WooCommerce Coupons plugin <= 4.6.8 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Josh Kohlbach Advanced Coupons for WooCommerce Coupons advanced-coupons-for-woocommerce-free.This issue affects Advanced Coupons for WooCommerce Coupons: from n/a through <= 4.6.8.

  Updated 2026-04-28
• CVE-2025-62014: WordPress ITok theme <= 1.1.42 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme ITok itok.This issue affects ITok: from n/a through <= 1.1.42.

  Updated 2026-04-28
• CVE-2025-62013: WordPress UiChemy plugin <= 4.0.0 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0.

  Updated 2026-04-28
• CVE-2025-62012: WordPress TheGem (Elementor) theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.

  Updated 2026-04-28
• CVE-2025-62011: WordPress TheGem theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.This issue affects TheGem: from n/a through <= 5.10.5.

  Updated 2026-04-28
• CVE-2025-62010: WordPress Famita theme <= 1.54 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Famita famita allows PHP Local File Inclusion.This issue affects Famita: from n/a through <= 1.54.

  Updated 2026-04-28
• CVE-2025-62009: WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability 4.3 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Cross Site Request Forgery.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.

  Updated 2026-04-28
• CVE-2025-62008: WordPress Product Table For WooCommerce plugin <= 1.2.4 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in acowebs Product Table For WooCommerce product-table-for-woocommerce.This issue affects Product Table For WooCommerce: from n/a through <= 1.2.4.

  Updated 2026-04-28
• CVE-2025-62007: WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability 8.8 High

  Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through <= 1.0.3.

  Updated 2026-04-28
• CVE-2025-62006: WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1.

  Updated 2026-04-28
• CVE-2025-62005: WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Cross Site Request Forgery (CSRF) vulnerability 7.1 High

  Cross-Site Request Forgery (CSRF) vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Cross Site Request Forgery.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

  Updated 2026-04-28
• CVE-2025-62004: BullWall Server Intrusion Protection (SIP) initialization race condition 7.7 High

  BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in after boot and before SIP MFA is running. The SIP services do not retroactively enforce MFA or disconnect sessions that were not subject to SIP MFA. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions mayy also be affect

  Updated 2026-01-15
• CVE-2025-62003: BullWall Server Intrusion Protection RDP MFA connection delay 7.7 High

  BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connections. A remote, authenticated attacker can potentially bypass detection during this delay. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other versions may also be affected.

  Updated 2026-01-15
• CVE-2025-62002: BullWall Ransomware Containment file count detection bypass 5.3 Medium

  BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large) file without triggering detection if thresholds are configured to require multiple file changes. The number of files to trigger detection can be configured by the user. Versions 4.6.0.0, 4.6.0.6, 4.6.0.7, and 4.6.1.4 are affected. Other vers

  Updated 2026-01-15
• CVE-2025-62001: BullWall Ransomware Containment hard-coded folder exclusions 8.7 High

  BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain exclusion patterns could allow an authenticated attacker to rename directories in a way that avoids monitoring. Fixed in 4.6.1.14 and 5.0.0.42, which remove hardcoded exclusion behavior and exposes exclusion handling as configurable setting

  Updated 2026-01-15
• CVE-2025-62000: BullWall Ransomware Containment incomplete file inspection 6.9 Medium

  BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based on header bytes. An authenticated attacker could encrypt files, preserving the first four bytes and preventing this particular method from triggering. The affected product implements additional integrity-based detection mechanisms capable o

  Updated 2026-01-15

Search a CVE ID or check dependency files →