CVE-2025-68xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

888 records · Page 9 of 9

• CVE-2025-68087: WordPress Modalier for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in merkulove Modalier for Elementor modalier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modalier for Elementor: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2025-68086: WordPress Reformer for Elementor plugin <= 1.0.6 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reformer for Elementor: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2025-68085: WordPress Buttoner for Elementor plugin <= 1.0.6 - Settings Change vulnerability 5.4 Medium

  Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Buttoner for Elementor: from n/a through <= 1.0.6.

  Updated 2026-04-28
• CVE-2025-68084: WordPress Ultimate Auction plugin <= 4.3.3 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Auction : from n/a through <= 4.3.3.

  Updated 2026-04-28
• CVE-2025-68083: WordPress Meks Quick Plugin Disabler plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affects Meks Quick Plugin Disabler: from n/a through <= 1.0.

  Updated 2026-04-28
• CVE-2025-68082: WordPress Semrush Content Toolkit plugin <= 1.1.32 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue affects Semrush Content Toolkit: from n/a through <= 1.1.32.

  Updated 2026-04-28
• CVE-2025-68081: WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.

  Updated 2026-07-23
• CVE-2025-68080: WordPress User Avatar - Reloaded plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal User Avatar - Reloaded user-avatar-reloaded allows Stored XSS.This issue affects User Avatar - Reloaded: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-68079: WordPress Salient Shortcodes plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Shortcodes salient-shortcodes allows Stored XSS.This issue affects Salient Shortcodes: from n/a through <= 1.5.4.

  Updated 2026-04-28
• CVE-2025-68078: WordPress Salient Portfolio theme <= 1.8.2 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows Stored XSS.This issue affects Salient Portfolio: from n/a through <= 1.8.2.

  Updated 2026-04-28
• CVE-2025-68077: WordPress Stockholm theme <= 9.14.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm stockholm allows Stored XSS.This issue affects Stockholm: from n/a through <= 9.14.1.

  Updated 2026-04-28
• CVE-2025-68076: WordPress Stockholm Core plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored XSS.This issue affects Stockholm Core: from n/a through <= 2.4.6.

  Updated 2026-04-28
• CVE-2025-68075: WordPress BNE Testimonials plugin <= 2.0.8 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions.

  Updated 2026-06-29
• CVE-2025-68074: WordPress Image Carousel plugin <= 1.0.0.41 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions.

  Updated 2026-06-26
• CVE-2025-68073: WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.

  Updated 2026-04-28
• CVE-2025-68072: WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.

  Updated 2026-04-28
• CVE-2025-68071: WordPress Essential Real Estate plugin <= 5.3.2 - Insecure Direct Object References (IDOR) vulnerability 6.5 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

  Updated 2026-04-28
• CVE-2025-68070: WordPress VK Google Job Posting Manager plugin <= 1.2.22 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Stored XSS.This issue affects VK Google Job Posting Manager: from n/a through <= 1.2.22.

  Updated 2026-04-28
• CVE-2025-68069: WordPress Directorist plugin <= 8.6.6 - Broken Access Control vulnerability 7.1 High

  Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Directorist: from n/a through <= 8.6.6.

  Updated 2026-04-28
• CVE-2025-68068: WordPress Stockholm theme <= 9.14.1 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm stockholm allows PHP Local File Inclusion.This issue affects Stockholm: from n/a through <= 9.14.1.

  Updated 2026-04-28
• CVE-2025-68067: WordPress Stockholm Core plugin <= 2.4.6 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm-core allows PHP Local File Inclusion.This issue affects Stockholm Core: from n/a through <= 2.4.6.

  Updated 2026-04-28
• CVE-2025-68066: WordPress Soledad theme <= 8.7.0 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP Local File Inclusion.This issue affects Soledad: from n/a through <= 8.7.0.

  Updated 2026-04-28
• CVE-2025-68065: WordPress Hub Core plugin < 6.0.2 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local File Inclusion. This issue affects Hub Core: from n/a before 6.0.2.

  Updated 2026-05-20
• CVE-2025-68064: WordPress Goya Core plugin < 1.0.9.4 - Local File Inclusion vulnerability 7.5 High

  Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.

  Updated 2026-06-26
• CVE-2025-68063: WordPress Splash - Sport Club WordPress theme for Basketball, Football, Hockey theme <= 4.4.3 - Local File Inclusion vulnerability 7.5 High

  Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions.

  Updated 2026-06-26
• CVE-2025-68062: WordPress MinimogWP theme <= 3.9.6 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP Local File Inclusion.This issue affects MinimogWP: from n/a through <= 3.9.6.

  Updated 2026-04-28
• CVE-2025-68061: WordPress EduMall theme <= 4.4.7 - Local File Inclusion vulnerability 7.5 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP Local File Inclusion.This issue affects EduMall: from n/a through <= 4.4.7.

  Updated 2026-04-28
• CVE-2025-68060: WordPress Team Member plugin <= 8.5 - SQL Injection vulnerability 7.6 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPMart Team Member allows Blind SQL Injection. This issue affects Team Member: from n/a through 8.5.

  Updated 2026-05-07
• CVE-2025-68059: WordPress Hotel Listing plugin <= 1.4.2 - Broken Access Control vulnerability 7.6 High

  Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Listing: from n/a through <= 1.4.2.

  Updated 2026-04-28
• CVE-2025-68058: WordPress Institutions Directory plugin <= 1.3..4 - Broken Access Control vulnerability 7.6 High

  Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through <= 1.3..4.

  Updated 2026-04-28
• CVE-2025-68057: WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability 7.6 High

  Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through <= 1.3.9.

  Updated 2026-04-28
• CVE-2025-68056: WordPress LBG Zoominoutslider plugin <= 5.4.4 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allows SQL Injection.This issue affects LBG Zoominoutslider: from n/a through <= 5.4.4.

  Updated 2026-04-28
• CVE-2025-68055: WordPress Hydra Booking plugin <= 1.1.32 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection.This issue affects Hydra Booking: from n/a through <= 1.1.32.

  Updated 2026-04-28
• CVE-2025-68054: WordPress CountDown With Image or Video Background plugin <= 1.5 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown With Image or Video Background countdown_with_background allows Blind SQL Injection.This issue affects CountDown With Image or Video Background: from n/a through <= 1.5.

  Updated 2026-04-28
• CVE-2025-68053: WordPress xPromoter plugin <= 1.3.4 - SQL Injection vulnerability 8.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup xPromoter top_bar_promoter allows Blind SQL Injection.This issue affects xPromoter: from n/a through <= 1.3.4.

  Updated 2026-04-28
• CVE-2025-68052: WordPress Eagle Booking plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability 8.8 High

  Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions.

  Updated 2026-06-26
• CVE-2025-68051: WordPress Shiprocket plugin <= 2.0.8 - Insecure Direct Object References (IDOR) vulnerability 7.5 High

  Authorization Bypass Through User-Controlled Key vulnerability in Shiprocket Shiprocket shiprocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shiprocket: from n/a through <= 2.0.8.

  Updated 2026-04-28
• CVE-2025-68050: WordPress Leadpages plugin <= 1.1.3 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leadpages: from n/a through <= 1.1.3.

  Updated 2026-04-28
• CVE-2025-68049: WordPress bunny.net plugin <= 2.3.6 - Broken Access Control vulnerability 6.3 Medium

  Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.

  Updated 2026-06-16
• CVE-2025-68048: WordPress NextMove Lite plugin <= 2.23.0 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NextMove Lite: from n/a through <= 2.23.0.

  Updated 2026-04-28
• CVE-2025-68047: WordPress Eventin plugin <= 4.1.3 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.

  Updated 2026-04-28
• CVE-2025-68046: WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability 6.5 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Builder: from n/a through <= 2.0.1.

  Updated 2026-04-28
• CVE-2025-68045: WordPress WP Event SOlution plugin <= 4.1.12 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.12.

  Updated 2026-10-21
• CVE-2025-68044: WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability 8.6 High

  Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.4.

  Updated 2026-04-28
• CVE-2025-68043: WordPress LottieFiles plugin <= 3.0.0 - Broken Access Control vulnerability 7.3 High

  Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LottieFiles: from n/a through <= 3.0.0.

  Updated 2026-04-28
• CVE-2025-68042: WordPress Travelpayouts plugin <= 1.2.2 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travelpayouts: from n/a through <= 1.2.2.

  Updated 2026-04-28
• CVE-2025-68041: WordPress Omnichannel for WooCommerce plugin <= 1.3.65 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codisto Omnichannel for WooCommerce codistoconnect allows Stored XSS.This issue affects Omnichannel for WooCommerce: from n/a through <= 1.3.65.

  Updated 2026-04-28
• CVE-2025-68040: WordPress WP Project Manager plugin <= 3.0.1 - Sensitive Data Exposure vulnerability 6.5 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in weDevs WP Project Manager wedevs-project-manager allows Retrieve Embedded Sensitive Data.This issue affects WP Project Manager: from n/a through <= 3.0.1.

  Updated 2026-04-28
• CVE-2025-68039: WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-68038: WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability 7.2 High

  Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Express Pro: from n/a through < 5.9.14.

  Updated 2026-04-28
• CVE-2025-68037: WordPress Export Media URLs plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atlas Gondal Export Media URLs export-media-urls allows Reflected XSS.This issue affects Export Media URLs: from n/a through <= 2.2.

  Updated 2026-04-29
• CVE-2025-68036: WordPress CubeWP plugin <= 1.1.27 - Broken Access Control vulnerability 7.5 High

  Missing Authorization vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CubeWP: from n/a through <= 1.1.27.

  Updated 2026-04-28
• CVE-2025-68035: WordPress Tabby Checkout plugin <= 5.8.4 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in tabbyai Tabby Checkout tabby-checkout allows Retrieve Embedded Sensitive Data.This issue affects Tabby Checkout: from n/a through <= 5.8.4.

  Updated 2026-04-28
• CVE-2025-68034: WordPress CleverReach® WP plugin <= 1.5.21 - SQL Injection vulnerability 9.3 Critical

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CleverReach® CleverReach® WP cleverreach-wp allows SQL Injection.This issue affects CleverReach® WP: from n/a through <= 1.5.21.

  Updated 2026-04-28
• CVE-2025-68033: WordPress Custom Related Posts plugin <= 1.8.0 - Sensitive Data Exposure vulnerability 7.5 High

  Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.This issue affects Custom Related Posts: from n/a through <= 1.8.0.

  Updated 2026-04-28
• CVE-2025-68032: WordPress Advanced WC Analytics plugin <= 3.19.0 - Settings Change vulnerability 6.5 Medium

  Missing Authorization vulnerability in Passionate Brains Advanced WC Analytics advance-wc-analytics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced WC Analytics: from n/a through <= 3.19.0.

  Updated 2026-04-28
• CVE-2025-68031: WordPress افزونه پیامک حرفه ای فراز اس ام اس plugin <= 2.7.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faraz sms افزونه پیامک حرفه ای فراز اس ام اس farazsms allows Reflected XSS.This issue affects افزونه پیامک حرفه ای فراز اس ام اس: from n/a through <= 2.7.3.

  Updated 2026-04-28
• CVE-2025-68030: WordPress Frontis Blocks plugin <= 1.1.5 - Server Side Request Forgery (SSRF) vulnerability 7.2 High

  Server-Side Request Forgery (SSRF) vulnerability in WP Messiah Frontis Blocks frontis-blocks allows Server Side Request Forgery.This issue affects Frontis Blocks: from n/a through <= 1.1.5.

  Updated 2026-04-28
• CVE-2025-68029: WordPress Wallet System for WooCommerce plugin <= 2.7.3 - Sensitive Data Exposure vulnerability 6.3 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Wallet System for WooCommerce: from n/a through <= 2.7.3.

  Updated 2026-04-29
• CVE-2025-68028: WordPress GA4WP: Google Analytics for WordPress plugin <= 2.10.0 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GA4WP: Google Analytics for WordPress: from n/a through <= 2.10.0.

  Updated 2026-04-28
• CVE-2025-68027: WordPress Hydra Booking plugin <= 1.1.32 - Privilege Escalation vulnerability 7.3 High

  Incorrect Privilege Assignment vulnerability in Themefic Hydra Booking hydra-booking allows Privilege Escalation.This issue affects Hydra Booking: from n/a through <= 1.1.32.

  Updated 2026-04-28
• CVE-2025-68026: WordPress LC Wizard plugin <= 2.1.1 - Settings Change vulnerability 6.5 Medium

  Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LC Wizard: from n/a through <= 2.1.1.

  Updated 2026-04-28
• CVE-2025-68025: WordPress Addonify Floating Cart For WooCommerce plugin <= 1.2.17 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify Floating Cart For WooCommerce: from n/a through <= 1.2.17.

  Updated 2026-04-28
• CVE-2025-68024: WordPress Addonify – WooCommerce Wishlist plugin <= 2.0.15 - Settings Change vulnerability 6.5 Medium

  Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – WooCommerce Wishlist: from n/a through <= 2.0.15.

  Updated 2026-04-28
• CVE-2025-68023: WordPress Addonify – Compare Products For WooCommerce plugin <= 1.1.17 - Settings Change vulnerability 6.5 Medium

  Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify – Compare Products For WooCommerce: from n/a through <= 1.1.17.

  Updated 2026-04-28
• CVE-2025-68022: WordPress Plugin BlueX for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability 7.3 High

  Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin BlueX for WooCommerce: from n/a through <= 3.1.6.

  Updated 2026-04-28
• CVE-2025-68021: WordPress ConveyThis plugin <= 269.9 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ConveyThis: from n/a through <= 269.9.

  Updated 2026-04-28
• CVE-2025-68020: WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.13.

  Updated 2026-04-28
• CVE-2025-68019: WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.

  Updated 2026-04-28
• CVE-2025-68018: WordPress Order Listener for WooCommerce plugin <= 3.6.1 - Broken Access Control vulnerability 9.4 Critical

  Missing Authorization vulnerability in StackWC Order Listener for WooCommerce woc-order-alert allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Listener for WooCommerce: from n/a through <= 3.6.1.

  Updated 2026-04-28
• CVE-2025-68017: WordPress Antideo Email Validator plugin <= 1.0.10 - SQL Injection vulnerability 7.5 High

  Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Antideo Antideo Email Validator antideo-email-validator allows Blind SQL Injection.This issue affects Antideo Email Validator: from n/a through <= 1.0.10.

  Updated 2026-04-28
• CVE-2025-68016: WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability 6.5 Medium

  Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooCommerce: from n/a through <= 1.1.2.

  Updated 2026-04-29
• CVE-2025-68015: WordPress Event Tickets with Ticket Scanner plugin <= 2.8.5 - Remote Code Execution (RCE) vulnerability 9.0 Critical

  Improper Control of Generation of Code ('Code Injection') vulnerability in Vollstart Event Tickets with Ticket Scanner event-tickets-with-ticket-scanner allows Code Injection.This issue affects Event Tickets with Ticket Scanner: from n/a through <= 2.8.5.

  Updated 2026-04-28
• CVE-2025-68014: WordPress AweBooking plugin <= 3.2.26 - Sensitive Data Exposure vulnerability 6.5 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects AweBooking: from n/a through <= 3.2.26.

  Updated 2026-04-28
• CVE-2025-68013: WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability 6.5 Medium

  Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooCommerce: from n/a through <= 2.1.2.

  Updated 2026-04-28
• CVE-2025-68012: WordPress CodeColorer plugin <= 0.10.1 - Stored Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dmytro Shteflyuk CodeColorer codecolorer allows Stored XSS.This issue affects CodeColorer: from n/a through <= 0.10.1.

  Updated 2026-04-28
• CVE-2025-68011: WordPress GLS Shipping for WooCommerce plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GLS GLS Shipping for WooCommerce gls-shipping-for-woocommerce allows Reflected XSS.This issue affects GLS Shipping for WooCommerce: from n/a through <= 1.4.0.

  Updated 2026-04-28
• CVE-2025-68010: WordPress Netgsm plugin <= 2.9.63 - Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through <= 2.9.63.

  Updated 2026-04-28
• CVE-2025-68009: WordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.

  Updated 2026-04-28
• CVE-2025-68008: WordPress WP Mail plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows Reflected XSS.This issue affects WP Mail: from n/a through <= 1.3.

  Updated 2026-04-28
• CVE-2025-68007: WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerability 6.5 Medium

  Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.

  Updated 2026-04-28
• CVE-2025-68006: WordPress Booking Ultra Pro plugin <= 1.1.23 - Sensitive Data Exposure vulnerability 6.5 Medium

  Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23.

  Updated 2026-04-28
• CVE-2025-68005: WordPress Easy Hotel Booking plugin <= 1.9.2 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Hotel Booking: from n/a through <= 1.9.2.

  Updated 2026-04-28
• CVE-2025-68004: WordPress My Post Order plugin <= 1.2.1.1 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kapil Chugh My Post Order my-posts-order allows Reflected XSS.This issue affects My Post Order: from n/a through <= 1.2.1.1.

  Updated 2026-04-28
• CVE-2025-68003: WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability 6.5 Medium

  Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.

  Updated 2026-04-28
• CVE-2025-68002: WordPress Open User Map plugin <= 1.4.16 - Arbitrary File Download vulnerability 6.5 Medium

  Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in 100plugins Open User Map open-user-map allows Path Traversal.This issue affects Open User Map: from n/a through <= 1.4.16.

  Updated 2026-04-28
• CVE-2025-68001: WordPress g-FFL Checkout plugin <= 2.1.0 - Arbitrary File Upload vulnerability 10.0 Critical

  Unrestricted Upload of File with Dangerous Type vulnerability in garidium g-FFL Checkout g-ffl-checkout allows Upload a Web Shell to a Web Server.This issue affects g-FFL Checkout: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-68000: WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.

  Updated 2026-04-28

Search a CVE ID or check dependency files →