Search
35,912 CVEs · Medium severity
CVEs (35,912, showing first 500)
Only the first 500 CVEs (by current sort) are shown when searching without a keyword. Add a search term above to narrow the results.
Showing 1–25 of 35,912 (capped at 500)
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2025-10874 | MEDIUM | Patched | 5.5 | 2025-10-24 | The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock… |
| CVE-2025-58070 | MEDIUM | 6.1 | 2025-10-24 | Pleasanter contains a stored cross-site scripting vulnerability in Preview for Attachments, which allows an attacker to execute an arbitrary script in a logged-in user's we… | |
| CVE-2025-61931 | MEDIUM | 5.4 | 2025-10-24 | Pleasanter contains a stored cross-site scripting vulnerability in Body, Description and Comments, which allows an attacker to execute an arbitrary script in a logged-in us… | |
| CVE-2025-9158 | MEDIUM | — | 2025-10-24 | The Request Tracker software is vulnerable to a Stored XSS vulnerability in calendar invitation parsing feature, which displays invitation data without HTML sanitization. X… | |
| CVE-2025-9978 | MEDIUM | Patched | 6.8 | 2025-10-24 | The Jeg Kit for Elementor WordPress plugin before 2.7.0 does not sanitize SVG file contents when uploaded via xmlrpc.php, leading to a cross site scripting vulnerability. |
| CVE-2025-10701 | MEDIUM | 6.4 | 2025-10-24 | The Time Clock – A WordPress Employee & Volunteer Time Clock Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up t… | |
| CVE-2025-10740 | MEDIUM | 6.3 | 2025-10-24 | The URL Shortener Plugin For WordPress plugin for WordPress is vulnerable to unauthorized access to functionality provided by the API due to a missing capability check on t… | |
| CVE-2025-10748 | MEDIUM | 6.5 | 2025-10-24 | The RapidResult plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to, and including, 1.2. This is due to insufficient escaping on… | |
| CVE-2025-10749 | MEDIUM | 5.4 | 2025-10-24 | The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is d… | |
| CVE-2025-10901 | MEDIUM | 4.3 | 2025-10-24 | The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'ai_get_table' function in all vers… | |
| CVE-2025-10902 | MEDIUM | 4.3 | 2025-10-24 | The Originality.ai AI Checker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ai_scan_result_remove' function in a… | |
| CVE-2025-11172 | MEDIUM | 4.3 | 2025-10-24 | The Check Plagiarism plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the chk_plag_mine_plugin_wpse10500_admin_a… | |
| CVE-2025-11257 | MEDIUM | 4.3 | 2025-10-24 | The LLM Hubspot Blog Import plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_save_blogs' AJAX endpo… | |
| CVE-2025-11887 | MEDIUM | 4.3 | 2025-10-24 | The Supervisor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on several AJAX functions in all versions up to, an… | |
| CVE-2025-11992 | MEDIUM | 6.1 | 2025-10-24 | The Multi Item Responsive Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incor… | |
| CVE-2025-12014 | MEDIUM | 4.3 | 2025-10-24 | The NGINX Cache Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nginxcacheoptimizer-blacklist-up… | |
| CVE-2025-12016 | MEDIUM | 4.4 | 2025-10-24 | The qnotsquiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qnotsquiz_custom_start_text' parameter in all versions up to, and including, 1.0.0 … | |
| CVE-2025-12017 | MEDIUM | 6.1 | 2025-10-24 | The VNPAY Payment gateway plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'message' parameter in all versions up to, and including, 1.0.0 due t… | |
| CVE-2025-12072 | MEDIUM | 4.3 | 2025-10-24 | The Disable Content Editor For Specific Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0. This is due to … | |
| CVE-2025-12096 | MEDIUM | 6.4 | 2025-10-24 | The Simple Excel Pricelist for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pricelist' shortcode in all versions up to, and includ… | |
| CVE-2025-12134 | MEDIUM | 5.3 | 2025-10-24 | The ZoloBlocks – Gutenberg Block Editor Plugin with Advanced Blocks, Dynamic Content, Templates & Patterns plugin for WordPress is vulnerable to unauthorized modification o… | |
| CVE-2025-12136 | MEDIUM | 6.8 | 2025-10-24 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.2.4. This i… | |
| CVE-2025-36361 | MEDIUM | Patched | 6.3 | 2025-10-24 | IBM App Connect Enterprise 13.0.1.0 through 13.0.4.2, and 12.0.1.0 through 12.0.12.17 could allow an authenticated user to perform unauthorized actions on customer defined … |
| CVE-2025-5350 | MEDIUM | 5.9 | 2025-10-24 | SSRF and Reflected XSS Vulnerabilities exist in multiple WSO2 products within the deprecated Try-It feature, which was accessible only to administrative users. This feature… | |
| CVE-2025-5605 | MEDIUM | 4.3 | 2025-10-24 | An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request U… |