Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
CVE-2025-22774 |
WordPress CRUDLab Scroll to Top Plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRUDLab CRUDLab Scroll to Top allows Reflected XSS. This issue affects CRUDLab Scroll to Top: from n/a through 1.0.1.
CVSS: HIGH (7.1) EPSS Score: 0.03% SSVC Exploitation: none
April 17th, 2025 (3 days ago)
|
|
CVE-2025-22692 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rachanaS Sponsered Link allows Reflected XSS. This issue affects Sponsered Link: from n/a through 4.0.
CVSS: HIGH (7.1) EPSS Score: 0.03% SSVC Exploitation: none
April 17th, 2025 (3 days ago)
|
|
CVE-2025-22651 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wppluginboxdev Stylish Google Sheet Reader allows Reflected XSS. This issue affects Stylish Google Sheet Reader: from n/a through 4.0.
CVSS: HIGH (7.1) EPSS Score: 0.03% SSVC Exploitation: none
April 17th, 2025 (3 days ago)
|
|
CVE-2025-22636 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vicente Ruiz Gálvez VR-Frases allows Reflected XSS. This issue affects VR-Frases: from n/a through 3.0.1.
CVSS: HIGH (8.2) EPSS Score: 0.04% SSVC Exploitation: none
April 17th, 2025 (3 days ago)
|
|
CVE-2025-22565 |
Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bill Zimmerman vooPlayer v4 allows Reflected XSS. This issue affects vooPlayer v4: from n/a through 4.0.4.
CVSS: HIGH (7.1) EPSS Score: 0.03% SSVC Exploitation: none
April 17th, 2025 (3 days ago)
|
|
CVE-2025-3294 |
Description: The WP Editor plugin for WordPress is vulnerable to arbitrary file update due to missing file path validation in all versions up to, and including, 1.2.9.1. This makes it possible for authenticated attackers, with Administrator-level access and above, to overwrite arbitrary files on the affected site's server which may make remote code execution possible assuming the files can be written to by the web server.
CVSS: HIGH (7.2) EPSS Score: 0.17%
April 17th, 2025 (3 days ago)
|
|
CVE-2024-1986 |
Description: The Booster Elite for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the wc_add_new_product() function in all versions up to, and including, 7.1.7. This makes it possible for customer-level attackers, and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. This is only exploitable when the user product upload functionality is enabled.
CVSS: HIGH (8.8) EPSS Score: 4.31% SSVC Exploitation: none
April 16th, 2025 (4 days ago)
|
|
CVE-2025-39592 |
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle Subscribe to Unlock Lite allows PHP Local File Inclusion. This issue affects Subscribe to Unlock Lite: from n/a through 1.3.0.
CVSS: HIGH (7.5) EPSS Score: 0.11%
April 16th, 2025 (4 days ago)
|
|
CVE-2025-39584 |
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Themewinter Eventin allows PHP Local File Inclusion. This issue affects Eventin: from n/a through 4.0.25.
CVSS: HIGH (7.5) EPSS Score: 0.11%
April 16th, 2025 (4 days ago)
|
|
CVE-2025-39570 |
Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Lomu WPCOM Member allows PHP Local File Inclusion. This issue affects WPCOM Member: from n/a through 1.7.7.
CVSS: HIGH (8.8) EPSS Score: 0.11%
April 16th, 2025 (4 days ago)
|