Latest CVE Feed

  1. Home
  2. Vulnerabilities
  3. Latest
Following is the list of latest published vulnerabilities. You can filter the list based on the severity of the vulnerability, whether it is actively exploited (also known as CISA KEV List) or remotely exploitable. You can also sort the list based on the published date, last updated date, or CVSS score.
Latest Critical Actively Exploited Remotely Exploitable
Published Last Updated CVSS Score

  • 9.8

    CRITICAL
    CVE-2025-53599

    Whale browser for iOS before 3.9.1.4206 allow an attacker to execute malicious scripts in the browser via a crafted javascript scheme.... Read more

    Affected Products : whale_browser
    • Published: Jul. 04, 2025
    • Modified: Jul. 08, 2025

  • 8.8

    HIGH
    CVE-2025-32918

    Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.... Read more

    Affected Products : checkmk checkmk
    • Published: Jul. 04, 2025
    • Modified: Aug. 22, 2025

  • 6.4

    MEDIUM
    CVE-2024-11937

    The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping... Read more

    Affected Products : premium_addons_for_elementor
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 6.4

    MEDIUM
    CVE-2025-6944

    The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uncode_hl_text' and 'uncode_text_icon' shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping ... Read more

    Affected Products :
    • Published: Jul. 04, 2025
    • Modified: Jul. 08, 2025

  • 8.8

    HIGH
    CVE-2025-5372

    A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh ... Read more

    • Published: Jul. 04, 2025
    • Modified: Aug. 22, 2025

  • 5.1

    MEDIUM
    CVE-2025-7053

    A vulnerability was found in Cockpit up to 2.11.3. It has been rated as problematic. This issue affects some unknown processing of the file /system/users/save. The manipulation of the argument name/email leads to cross site scripting. The attack may be in... Read more

    Affected Products : cockpit
    • Published: Jul. 04, 2025
    • Modified: Jul. 08, 2025

  • 6.4

    MEDIUM
    CVE-2025-7046

    The Portfolio for Elementor & Image Gallery | PowerFolio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS Attributes of Plugin's widgets in all versions up to, and including, 3.2.0 due to insufficient input sanitization ... Read more

    Affected Products : powerfolio
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 7.5

    HIGH
    CVE-2025-6814

    The Booking X plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_now() function in versions 1.0 to 1.1.2. This makes it possible for unauthenticated attackers to download all plugin data, incl... Read more

    Affected Products :
    • Published: Jul. 04, 2025
    • Modified: Jul. 08, 2025

  • 6.4

    MEDIUM
    CVE-2025-6787

    The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'smartdocs_search' shortcode in all versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping on user supplied attribut... Read more

    Affected Products : smart_docs
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 5.3

    MEDIUM
    CVE-2025-6786

    The DocCheck Login plugin for WordPress is vulnerable to unauthorized post access in all versions up to, and including, 1.1.5. This is due to plugin redirecting a user to login on a password protected post after the page has loaded. This makes it possible... Read more

    Affected Products :
    • Published: Jul. 04, 2025
    • Modified: Jul. 08, 2025

  • 7.5

    HIGH
    CVE-2025-6783

    The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the emdedSc() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficient prepa... Read more

    Affected Products : gozen_forms
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 7.5

    HIGH
    CVE-2025-6782

    The GoZen Forms plugin for WordPress is vulnerable to SQL Injection via the 'forms-id' parameter of the dirGZActiveForm() function in all versions up to, and including, 1.1.5 due to insufficient escaping on the user supplied parameter and lack of sufficie... Read more

    Affected Products : gozen_forms
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 6.5

    MEDIUM
    CVE-2025-6739

    The WPQuiz plugin for WordPress is vulnerable to SQL Injection via the 'id' attribute of the 'wpquiz' shortcode in all versions up to, and including, 0.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t... Read more

    Affected Products : wpquiz
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 6.4

    MEDIUM
    CVE-2025-6729

    The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-leve... Read more

    Affected Products : paymaster_for_woocommerce
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 7.2

    HIGH
    CVE-2025-6586

    The Download Plugin plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the dpwap_plugin_locInstall function in all versions up to, and including, 2.2.8. This makes it possible for authenticated attackers, w... Read more

    Affected Products : download_plugin
    • Published: Jul. 04, 2025
    • Modified: Jul. 09, 2025

  • 8.0

    HIGH
    CVE-2025-6238

    The AI Engine plugin for WordPress is vulnerable to open redirect in version 2.8.4. This is due to an insecure OAuth implementation, as the 'redirect_uri' parameter is missing validation during the authorization flow. This makes it possible for unauthenti... Read more

    Affected Products : ai_engine ai_engine
    • Published: Jul. 04, 2025
    • Modified: Aug. 13, 2025

  • 6.1

    MEDIUM
    CVE-2025-6041

    The yContributors plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5. This is due to missing or incorrect nonce validation on the 'yContributors' page. This makes it possible for unauthenticated atta... Read more

    Affected Products :
    • Published: Jul. 04, 2025
    • Modified: Jul. 08, 2025

  • 6.4

    MEDIUM
    CVE-2025-6039

    The ProcessingJS for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pjs4wp' shortcode in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping on user supplied at... Read more

    Affected Products :
    • Published: Jul. 04, 2025
    • Modified: Jul. 08, 2025

  • 8.1

    HIGH
    CVE-2025-5956

    The WP Human Resource Management plugin for WordPress is vulnerable to Arbitrary User Deletion due to a missing authorization within the ajax_delete_employee() function in versions 2.0.0 through 2.2.17. The plugin’s deletion handler reads the client-suppl... Read more

    Affected Products : wp_human_resource_management
    • Published: Jul. 04, 2025
    • Modified: Aug. 13, 2025

  • 8.8

    HIGH
    CVE-2025-5953

    The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajax_insert_employee() and update_empoyee() functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-suppl... Read more

    Affected Products : wp_human_resource_management
    • Published: Jul. 04, 2025
    • Modified: Aug. 13, 2025
Showing 20 of 291058 Results