Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 7.5

    HIGH
    CVE-2025-2025

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the give_reports_earnings() function in all versions up to, and including, 3.22.0. This makes it p... Read more

    Affected Products : givewp
    • Published: Mar. 15, 2025
    • Modified: Mar. 25, 2025
    • Vuln Type: Information Disclosure

  • 4.3

    MEDIUM
    CVE-2025-1530

    The Tripetto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 8.0.9. This is due to missing nonce validation. This makes it possible for unauthenticated attackers to delete arbitrary results via a forg... Read more

    Affected Products : tripetto
    • Published: Mar. 15, 2025
    • Modified: Mar. 25, 2025
    • Vuln Type: Cross-Site Request Forgery

  • 4.3

    MEDIUM
    CVE-2025-1057

    A flaw was found in Keylime, a remote attestation solution, where strict type checking introduced in version 7.12.0 prevents the registrar from reading database entries created by previous versions, for example, 7.11.0. Specifically, older versions store ... Read more

    Affected Products : keylime
    • Published: Mar. 15, 2025
    • Modified: Mar. 15, 2025
    • Vuln Type: Misconfiguration

  • 7.2

    HIGH
    CVE-2025-2325

    The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers... Read more

    Affected Products : wp_test_email
    • Published: Mar. 15, 2025
    • Modified: Mar. 25, 2025
    • Vuln Type: Cross-Site Scripting

  • 3.3

    LOW
    CVE-2025-2157

    A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclo... Read more

    Affected Products :
    • Published: Mar. 15, 2025
    • Modified: Mar. 15, 2025
    • Vuln Type: Information Disclosure

  • 4.9

    MEDIUM
    CVE-2019-25222

    The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exis... Read more

    Affected Products : thumbnail_carousel_slider
    • Published: Mar. 15, 2025
    • Modified: Mar. 21, 2025
    • Vuln Type: Injection

  • 8.6

    HIGH
    CVE-2025-30066

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which ... Read more

    Affected Products : changed-files
    • Actively Exploited
    • Published: Mar. 15, 2025
    • Modified: Mar. 29, 2025
    • Vuln Type: Information Disclosure

  • 6.1

    MEDIUM
    CVE-2025-1773

    The Traveler theme for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple parameters in all versions up to, and including, 3.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated att... Read more

    Affected Products : traveler
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Cross-Site Scripting

  • 9.8

    CRITICAL
    CVE-2025-1771

    The Traveler theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.1.8 via the 'hotel_alone_load_more_post' function 'style' parameter. This makes it possible for unauthenticated attackers to include and execute... Read more

    Affected Products : traveler
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025

  • 7.2

    HIGH
    CVE-2024-13497

    The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization... Read more

    Affected Products : tripetto
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Cross-Site Scripting

  • 6.5

    MEDIUM
    CVE-2025-2267

    The WP01 plugin for WordPress is vulnerable to Arbitrary File Download in all versions up to, and including, 2.6.2 due to a missing capability check and insufficient restrictions on the make_archive() function. This makes it possible for authenticated att... Read more

    Affected Products : wp01
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Path Traversal

  • 6.1

    MEDIUM
    CVE-2025-2164

    The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'post_id' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible fo... Read more

    Affected Products : pixelstats
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Cross-Site Scripting

  • 6.1

    MEDIUM
    CVE-2025-2163

    The Zoorum Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9. This is due to missing or incorrect nonce validation on the zoorum_set_options() function. This makes it possible for unauthen... Read more

    Affected Products : zoorum_comments
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Cross-Site Request Forgery

  • 6.5

    MEDIUM
    CVE-2025-1670

    The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'cid' parameter in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient prepar... Read more

    Affected Products : wpschoolpress
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Injection

  • 6.5

    MEDIUM
    CVE-2025-1669

    The School Management System – WPSchoolPress plugin for WordPress is vulnerable to SQL Injection via the 'addNotify' action in all versions up to, and including, 2.2.16 due to insufficient escaping on the user supplied parameter and lack of sufficient pre... Read more

    Affected Products : wpschoolpress
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Injection

  • 5.4

    MEDIUM
    CVE-2025-1668

    The School Management System – WPSchoolPress plugin for WordPress is vulnerable to arbitrary user deletion due to a missing capability check on the wpsp_DeleteUser() function in all versions up to, and including, 2.2.16. This makes it possible for authent... Read more

    Affected Products : wpschoolpress
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Authorization

  • 8.8

    HIGH
    CVE-2025-1667

    The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it possible for authent... Read more

    Affected Products : wpschoolpress
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Authorization

  • 6.5

    MEDIUM
    CVE-2024-12336

    The WC Affiliate – A Complete WooCommerce Affiliate Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'export_all_data' function in all versions up to, and including, 2.5.3. This makes it pos... Read more

    Affected Products : wc_affiliate
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Authorization

  • 8.8

    HIGH
    CVE-2025-1657

    The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including,... Read more

    Affected Products : ulisting
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Authentication

  • 8.8

    HIGH
    CVE-2025-1653

    The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.1.7. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user me... Read more

    Affected Products : ulisting
    • Published: Mar. 15, 2025
    • Modified: Mar. 28, 2025
    • Vuln Type: Authorization
Showing 20 of 293258 Results