Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Security Vulnerabilities328206
CVE-2025-62963
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 13.88%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Estatik plugin <= 4.1.13 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Estatik Estatik estatik allows DOM-Based XSS.This issue affects Estatik: from n/a through <= 4.1.13.

Action-Not Available
Vendor-Estatik
Product-Estatik
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62962
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.02% / 5.85%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress CloudSearch plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Andrea Landonio CloudSearch cloud-search allows Stored XSS.This issue affects CloudSearch: from n/a through <= 3.0.0.

Action-Not Available
Vendor-Andrea Landonio
Product-CloudSearch
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-62959
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-9.1||CRITICAL
EPSS-0.07% / 20.62%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Paid Videochat Turnkey Site plugin <= 7.3.22 - Remote Code Execution (RCE) vulnerability

Improper Control of Generation of Code ('Code Injection') vulnerability in videowhisper Paid Videochat Turnkey Site ppv-live-webcams allows Remote Code Inclusion.This issue affects Paid Videochat Turnkey Site: from n/a through <= 7.3.22.

Action-Not Available
Vendor-videowhisper
Product-Paid Videochat Turnkey Site
CWE ID-CWE-94
Improper Control of Generation of Code ('Code Injection')
CVE-2025-62958
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.02% / 5.85%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Simple Content Templates for Blog Posts & Pages plugin <= 2.2.61 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Clifton Griffin Simple Content Templates for Blog Posts &amp; Pages simple-post-template allows Cross Site Request Forgery.This issue affects Simple Content Templates for Blog Posts &amp; Pages: from n/a through <= 2.2.61.

Action-Not Available
Vendor-Clifton Griffin
Product-Simple Content Templates for Blog Posts &amp; Pages
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-62957
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.02% / 5.85%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress NikanWP WooCommerce Reporting plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in NikanWP NikanWP WooCommerce Reporting wc-reports-lite allows Stored XSS.This issue affects NikanWP WooCommerce Reporting: from n/a through <= 1.0.0.

Action-Not Available
Vendor-NikanWP
Product-NikanWP WooCommerce Reporting
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-62956
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.02% / 5.85%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Reloadly plugin <= 2.0.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in iseremet Reloadly reloadly-topup-widget allows Stored XSS.This issue affects Reloadly: from n/a through <= 2.0.1.

Action-Not Available
Vendor-iseremet
Product-Reloadly
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-62954
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Revive Old Posts plugin <= 9.3.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Codeinwp Revive Old Posts tweet-old-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Revive Old Posts: from n/a through <= 9.3.3.

Action-Not Available
Vendor-Codeinwp
Product-Revive Old Posts
CWE ID-CWE-862
Missing Authorization
CVE-2025-62953
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Welcart e-Commerce plugin <= 2.11.24 - Broken Access Control vulnerability

Missing Authorization vulnerability in nanbu Welcart e-Commerce usc-e-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Welcart e-Commerce: from n/a through <= 2.11.24.

Action-Not Available
Vendor-nanbu
Product-Welcart e-Commerce
CWE ID-CWE-862
Missing Authorization
CVE-2025-62952
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress ChatBot plugin <= 7.3.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 7.3.0.

Action-Not Available
Vendor-QuantumCloud
Product-ChatBot
CWE ID-CWE-862
Missing Authorization
CVE-2025-62951
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 13.88%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Interactive Content – H5P plugin <= 1.16.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in icc0rz Interactive Content – H5P h5p allows Stored XSS.This issue affects Interactive Content – H5P: from n/a through <= 1.16.0.

Action-Not Available
Vendor-icc0rz
Product-Interactive Content – H5P
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62949
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 13.88%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Stored XSS.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through <= 1.1.2.

Action-Not Available
Vendor-BuddyDev
Product-Activity Plus Reloaded for BuddyPress
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62948
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 13.88%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Date counter plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Konstantin Pankratov Date counter date-counter allows Stored XSS.This issue affects Date counter: from n/a through <= 2.0.3.

Action-Not Available
Vendor-Konstantin Pankratov
Product-Date counter
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62947
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-7.5||HIGH
EPSS-0.05% / 14.31%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Publitio plugin <= 2.2.3 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in publitio Publitio publitio allows Retrieve Embedded Sensitive Data.This issue affects Publitio: from n/a through <= 2.2.3.

Action-Not Available
Vendor-publitio
Product-Publitio
CWE ID-CWE-201
Insertion of Sensitive Information Into Sent Data
CVE-2025-62946
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Everest Backup plugin <= 2.3.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in everestthemes Everest Backup everest-backup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Everest Backup: from n/a through <= 2.3.8.

Action-Not Available
Vendor-everestthemes
Product-Everest Backup
CWE ID-CWE-862
Missing Authorization
CVE-2025-62945
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.02% / 5.85%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Did Prestashop Display plugin <= 1.0.30 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Eduard Pinuaga Linares Did Prestashop Display did-prestashop-display allows Stored XSS.This issue affects Did Prestashop Display: from n/a through <= 1.0.30.

Action-Not Available
Vendor-Eduard Pinuaga Linares
Product-Did Prestashop Display
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-62944
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-9.8||CRITICAL
EPSS-0.06% / 19.69%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress MSTW CSV EXPORTER plugin <= 1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in Mark O'Donnell MSTW CSV EXPORTER mstw-csv-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSTW CSV EXPORTER: from n/a through <= 1.4.

Action-Not Available
Vendor-Mark O'Donnell
Product-MSTW CSV EXPORTER
CWE ID-CWE-862
Missing Authorization
CVE-2025-62943
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Next Page, Not Next Post plugin <= 0.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt McInvale Next Page, Not Next Post next-page-not-next-post allows Stored XSS.This issue affects Next Page, Not Next Post: from n/a through <= 0.3.0.

Action-Not Available
Vendor-Matt McInvale
Product-Next Page, Not Next Post
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62942
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress WP Mapbox GL JS Maps plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tempranova WP Mapbox GL JS Maps wp-mapbox-gl-js allows Stored XSS.This issue affects WP Mapbox GL JS Maps: from n/a through <= 3.0.1.

Action-Not Available
Vendor-tempranova
Product-WP Mapbox GL JS Maps
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62941
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Events Maker by dFactory plugin <= 1.6.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dFactory Events Maker by dFactory events-maker allows Stored XSS.This issue affects Events Maker by dFactory: from n/a through <= 1.6.14.

Action-Not Available
Vendor-dFactory
Product-Events Maker by dFactory
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62940
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Blox Lite plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nick Diego Blox Lite blox-lite allows Stored XSS.This issue affects Blox Lite: from n/a through <= 1.2.8.

Action-Not Available
Vendor-Nick Diego
Product-Blox Lite
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62939
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Open Currency Converter plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Open Currency Converter artiss-currency-converter allows Stored XSS.This issue affects Open Currency Converter: from n/a through <= 1.5.0.

Action-Not Available
Vendor-Joe
Product-Open Currency Converter
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62938
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Reoon Email Verifier plugin <= 2.0.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in Reoon Technology Reoon Email Verifier reoon-email-verifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reoon Email Verifier: from n/a through <= 2.0.1.

Action-Not Available
Vendor-Reoon Technology
Product-Reoon Email Verifier
CWE ID-CWE-862
Missing Authorization
CVE-2025-62937
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Post List Featured Image plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Johnny Post List Featured Image post-list-featured-image allows Stored XSS.This issue affects Post List Featured Image: from n/a through <= 0.5.9.

Action-Not Available
Vendor-Johnny
Product-Post List Featured Image
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62936
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.1||MEDIUM
EPSS-0.04% / 11.66%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress xSmart theme <= 1.2.9.4 - Content Injection vulnerability

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through <= 1.2.9.4.

Action-Not Available
Vendor-Jthemes
Product-xSmart
CWE ID-CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CVE-2025-62935
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Open Close WooCommerce Store plugin <= 4.9.8 - Broken Access Control vulnerability

Missing Authorization vulnerability in ilmosys Open Close WooCommerce Store woc-open-close allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Open Close WooCommerce Store: from n/a through <= 4.9.8.

Action-Not Available
Vendor-ilmosys
Product-Open Close WooCommerce Store
CWE ID-CWE-862
Missing Authorization
CVE-2025-62934
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.02% / 5.85%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress WP Business Hours plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Mejar WP Business Hours wp-business-hours allows Stored XSS.This issue affects WP Business Hours: from n/a through <= 1.4.

Action-Not Available
Vendor-Mejar
Product-WP Business Hours
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-62933
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.02% / 5.85%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Awesome Testimonials plugin <= 2.2.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery (CSRF) vulnerability in Prakash Awesome Testimonials awesome-testimonials allows Stored XSS.This issue affects Awesome Testimonials: from n/a through <= 2.2.1.

Action-Not Available
Vendor-Prakash
Product-Awesome Testimonials
CWE ID-CWE-352
Cross-Site Request Forgery (CSRF)
CVE-2025-62932
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Table Block by RioVizual plugin <= 2.3.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in wprio Table Block by RioVizual riovizual allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Table Block by RioVizual: from n/a through <= 2.3.2.

Action-Not Available
Vendor-wprio
Product-Table Block by RioVizual
CWE ID-CWE-862
Missing Authorization
CVE-2025-62931
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress MSN Partner Hub plugin <= 2.8.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in microsoftstart MSN Partner Hub microsoft-start allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MSN Partner Hub: from n/a through <= 2.8.7.

Action-Not Available
Vendor-microsoftstart
Product-MSN Partner Hub
CWE ID-CWE-862
Missing Authorization
CVE-2025-62930
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.1||MEDIUM
EPSS-0.04% / 11.92%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress MapSVG plugin <= 8.7.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg-lite-interactive-vector-maps allows DOM-Based XSS.This issue affects MapSVG: from n/a through <= 8.7.15.

Action-Not Available
Vendor-RomanCode
Product-MapSVG
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62929
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Testimonial Slider plugin <= 2.0.15 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonial Slider: from n/a through <= 2.0.15.

Action-Not Available
Vendor-PickPlugins
Product-Testimonial Slider
CWE ID-CWE-862
Missing Authorization
CVE-2025-62928
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:34
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress SEO Meta Description Updater plugin <= 1.2.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Joby Joseph SEO Meta Description Updater seo-meta-description-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Meta Description Updater: from n/a through <= 1.2.0.

Action-Not Available
Vendor-Joby Joseph
Product-SEO Meta Description Updater
CWE ID-CWE-862
Missing Authorization
CVE-2025-62927
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Nelio Content plugin <= 4.0.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Nelio Software Nelio Content nelio-content allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nelio Content: from n/a through <= 4.0.5.

Action-Not Available
Vendor-Nelio Software
Product-Nelio Content
CWE ID-CWE-862
Missing Authorization
CVE-2025-62925
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Conversios.io plugin <= 7.2.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in Conversios Conversios.io enhanced-e-commerce-for-woocommerce-store allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Conversios.io: from n/a through <= 7.2.10.

Action-Not Available
Vendor-Conversios
Product-Conversios.io
CWE ID-CWE-862
Missing Authorization
CVE-2025-62924
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Post Grid and Gutenberg Blocks plugin <= 2.3.17 - Broken Access Control vulnerability

Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.17.

Action-Not Available
Vendor-PickPlugins
Product-Post Grid and Gutenberg Blocks
CWE ID-CWE-862
Missing Authorization
CVE-2025-62923
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.1||MEDIUM
EPSS-0.04% / 11.92%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Marquee Addons for Elementor plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Debuggers Studio Marquee Addons for Elementor marquee-addons-for-elementor allows DOM-Based XSS.This issue affects Marquee Addons for Elementor: from n/a through <= 3.7.12.

Action-Not Available
Vendor-Debuggers Studio
Product-Marquee Addons for Elementor
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62922
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Export Categories plugin <= 1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Shambhu Patnaik Export Categories export-categories allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Export Categories: from n/a through <= 1.0.

Action-Not Available
Vendor-Shambhu Patnaik
Product-Export Categories
CWE ID-CWE-862
Missing Authorization
CVE-2025-62921
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-6.5||MEDIUM
EPSS-0.04% / 13.88%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Bulk Auto Image Title Attribute plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pagup Bulk Auto Image Title Attribute bulk-image-title-attribute allows DOM-Based XSS.This issue affects Bulk Auto Image Title Attribute: from n/a through <= 2.0.1.

Action-Not Available
Vendor-Pagup
Product-Bulk Auto Image Title Attribute
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62920
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress USERCENTRICS CMP plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webnique USERCENTRICS CMP usercentrics-consent-management-platform allows Stored XSS.This issue affects USERCENTRICS CMP: from n/a through <= 1.0.9.

Action-Not Available
Vendor-webnique
Product-USERCENTRICS CMP
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62919
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-9.1||CRITICAL
EPSS-0.06% / 18.42%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress TS Demo Importer plugin <= 0.1.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in themeshopy TS Demo Importer ts-demo-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Demo Importer: from n/a through <= 0.1.2.

Action-Not Available
Vendor-themeshopy
Product-TS Demo Importer
CWE ID-CWE-862
Missing Authorization
CVE-2025-62918
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress IgnitionDeck plugin <= 2.0.10 - Broken Access Control vulnerability

Missing Authorization vulnerability in ignitionwp IgnitionDeck ignitiondeck allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IgnitionDeck: from n/a through <= 2.0.10.

Action-Not Available
Vendor-ignitionwp
Product-IgnitionDeck
CWE ID-CWE-862
Missing Authorization
CVE-2025-62917
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Tooltipy plugin <= 5.5.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.9.

Action-Not Available
Vendor-Jamel.Z
Product-Tooltipy
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62916
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.8||HIGH
EPSS-0.06% / 18.56%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Flights & Hotels Booking WP Plugin plugin <= 3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in adivaha® Flights &amp; Hotels Booking WP Plugin adiaha-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flights &amp; Hotels Booking WP Plugin: from n/a through <= 3.1.

Action-Not Available
Vendor-adivaha®
Product-Flights &amp; Hotels Booking WP Plugin
CWE ID-CWE-862
Missing Authorization
CVE-2025-62915
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress SMS Contact Form 7 Notifications by ClickSend plugin <= 1.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in clicksend SMS Contact Form 7 Notifications by ClickSend clicksend-contactform7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMS Contact Form 7 Notifications by ClickSend: from n/a through <= 1.4.0.

Action-Not Available
Vendor-clicksend
Product-SMS Contact Form 7 Notifications by ClickSend
CWE ID-CWE-862
Missing Authorization
CVE-2025-62913
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Opal Service plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Service opal-service allows Stored XSS.This issue affects Opal Service: from n/a through <= 1.9.1.

Action-Not Available
Vendor-wpopal
Product-Opal Service
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62912
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress SiteGround Email Marketing plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.1.

Action-Not Available
Vendor-SiteGround
Product-SiteGround Email Marketing
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62911
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Rock Convert plugin <= 3.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Content Rock Convert rock-convert allows Stored XSS.This issue affects Rock Convert: from n/a through <= 3.0.1.

Action-Not Available
Vendor-Rock Content
Product-Rock Convert
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62910
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Video Gallery by Huzzaz plugin <= 10.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS.This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5.

Action-Not Available
Vendor-deshine
Product-Video Gallery by Huzzaz
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2025-62909
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-8.1||HIGH
EPSS-0.04% / 12.84%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Smart WeTransfer plugin <= 1.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in mrityunjay Smart WeTransfer smart-wetransfer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smart WeTransfer: from n/a through <= 1.3.

Action-Not Available
Vendor-mrityunjay
Product-Smart WeTransfer
CWE ID-CWE-862
Missing Authorization
CVE-2025-62908
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-Not Assigned
EPSS-0.05% / 12.52%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-21 Nov, 2025 | 09:15
Rejected-21 Nov, 2025 | 08:16
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Action-Not Available
Vendor-
Product-
CVE-2025-62907
Assigner-Patchstack
ShareView Details
Assigner-Patchstack
CVSS Score-5.4||MEDIUM
EPSS-0.04% / 11.75%
||
7 Day CHG~0.00%
Published-27 Oct, 2025 | 01:33
Updated-13 Nov, 2025 | 11:17
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WordPress Custom Post Type Attachment plugin <= 3.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Custom Post Type Attachment custom-post-type-pdf-attachment allows Stored XSS.This issue affects Custom Post Type Attachment: from n/a through <= 3.4.6.

Action-Not Available
Vendor-aviplugins.com
Product-Custom Post Type Attachment
CWE ID-CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • Previous
  • 1
  • 2
  • ...
  • 232
  • 233
  • 234
  • ...
  • 6564
  • 6565
  • Next