CVE-2025-69xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

532 records · Page 6 of 6

• CVE-2025-69032: WordPress FiveStar theme <= 1.7 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes FiveStar fivestar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiveStar: from n/a through <= 1.7.

  Updated 2026-04-28
• CVE-2025-69031: WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.

  Updated 2026-04-28
• CVE-2025-69030: WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.

  Updated 2026-04-28
• CVE-2025-69029: WordPress Struktur theme <= 2.5.1 - Insecure Direct Object References (IDOR) vulnerability 5.4 Medium

  Authorization Bypass Through User-Controlled Key vulnerability in Select-Themes Struktur struktur allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Struktur: from n/a through <= 2.5.1.

  Updated 2026-04-28
• CVE-2025-69028: WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.

  Updated 2026-04-28
• CVE-2025-69027: WordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for WooCommerce – Lite: from n/a through <= 3.2.0.

  Updated 2026-04-28
• CVE-2025-69026: WordPress PopupKit plugin <= 2.1.5 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roxnor PopupKit popup-builder-block allows Retrieve Embedded Sensitive Data.This issue affects PopupKit: from n/a through <= 2.1.5.

  Updated 2026-04-28
• CVE-2025-69025: WordPress Poptics plugin <= 1.0.20 - Sensitive Data Exposure vulnerability 4.3 Medium

  Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.

  Updated 2026-04-28
• CVE-2025-69024: WordPress BizPrint plugin <= 4.6.7 - Broken Access Control vulnerability 6.5 Medium

  Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.

  Updated 2026-04-28
• CVE-2025-69023: WordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.

  Updated 2026-04-28
• CVE-2025-69022: WordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerability 5.4 Medium

  Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.

  Updated 2026-04-28
• CVE-2025-69021: WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability 5.4 Medium

  Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.

  Updated 2026-04-28
• CVE-2025-69020: WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.

  Updated 2026-04-28
• CVE-2025-69019: WordPress FlippingBook plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affects FlippingBook: from n/a through <= 2.0.1.

  Updated 2026-04-28
• CVE-2025-69018: WordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.

  Updated 2026-04-28
• CVE-2025-69017: WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.

  Updated 2026-04-28
• CVE-2025-69016: WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a through 2.17.22.

  Updated 2026-10-07
• CVE-2025-69015: WordPress Crowdsignal Forms plugin <= 1.7.2 - Broken Access Control vulnerability 3.8 Low

  Missing Authorization vulnerability in Automattic Crowdsignal Forms crowdsignal-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crowdsignal Forms: from n/a through <= 1.7.2.

  Updated 2026-04-28
• CVE-2025-69014: WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability 4.9 Medium

  Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.

  Updated 2026-04-28
• CVE-2025-69013: WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.

  Updated 2026-04-28
• CVE-2025-69012: WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability 4.3 Medium

  Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.

  Updated 2026-04-28
• CVE-2025-69011: WordPress Cool Tag Cloud plugin <= 2.29 - Cross Site Scripting (XSS) vulnerability 6.5 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Cool Tag Cloud cool-tag-cloud allows Stored XSS.This issue affects Cool Tag Cloud: from n/a through <= 2.29.

  Updated 2026-04-28
• CVE-2025-69010: WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.

  Updated 2026-04-28
• CVE-2025-69009: WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability 5.3 Medium

  Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.

  Updated 2026-04-28
• CVE-2025-69008: WordPress Inboxify Sign Up Form plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allows Stored XSS.This issue affects Inboxify Sign Up Form: from n/a through <= 1.0.4.

  Updated 2026-04-28
• CVE-2025-69007: WordPress Popping Sidebars and Widgets Light plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Stored XSS.This issue affects Popping Sidebars and Widgets Light: from n/a through <= 1.27.

  Updated 2026-04-28
• CVE-2025-69006: WordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability 5.9 Medium

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This issue affects AM Events: from n/a through <= 1.13.1.

  Updated 2026-04-28
• CVE-2025-69005: WordPress Search & Go theme <= 2.8 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Search & Go search-and-go allows PHP Local File Inclusion.This issue affects Search & Go: from n/a through <= 2.8.

  Updated 2026-04-28
• CVE-2025-69004: WordPress Bajaar - Highly Customizable WooCommerce WordPress Theme theme <= 2.1.0 - Local File Inclusion vulnerability 8.1 High

  Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in XpeedStudio Bajaar - Highly Customizable WooCommerce WordPress Theme bajaar allows PHP Local File Inclusion.This issue affects Bajaar - Highly Customizable WooCommerce WordPress Theme: from n/a through <= 2.1.0.

  Updated 2026-04-28
• CVE-2025-69003: WordPress KenthaRadio theme <= 2.2.0 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QantumThemes KenthaRadio qt-kentharadio allows Reflected XSS.This issue affects KenthaRadio: from n/a through <= 2.2.0.

  Updated 2026-04-28
• CVE-2025-69002: WordPress OneLife theme <= 3.9 - PHP Object Injection vulnerability 8.8 High

  Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.

  Updated 2026-04-28
• CVE-2025-69001: WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability 5.3 Medium

  Improper Control of Generation of Code ('Code Injection') vulnerability in Shahjahan Jewel FluentForm fluentform allows Code Injection.This issue affects FluentForm: from n/a through <= 6.1.11.

  Updated 2026-04-28

Search a CVE ID or check dependency files →