CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-39545	WordPress WordPress REST API Authentication <= 3.6.3 - Settings Change Vulnerability Description: Missing Authorization vulnerability in miniOrange WordPress REST API Authentication allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress REST API Authentication: from n/a through 3.6.3. CVSS: MEDIUM (5.4) EPSS Score: 0.05% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39543	WordPress Royal Elementor Addons plugin <= 1.3.977 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons allows Stored XSS. This issue affects Royal Elementor Addons: from n/a through 1.3.977. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39540	WordPress WP Flipclock plugin <= 1.9 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP Flipclock allows DOM-Based XSS. This issue affects WP Flipclock: from n/a through 1.9. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39538	WordPress WP-Advanced-Search <= 3.3.9.3 - Arbitrary File Upload Vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search allows Upload a Web Shell to a Web Server. This issue affects WP-Advanced-Search: from n/a through 3.3.9.3. CVSS: MEDIUM (6.6) EPSS Score: 0.05% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39531	WordPress Slazzer Background Changer <= 3.14 - Broken Access Control Vulnerability Description: Missing Authorization vulnerability in slazzercom Slazzer Background Changer allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Slazzer Background Changer: from n/a through 3.14. CVSS: MEDIUM (5.3) EPSS Score: 0.05% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39529	WordPress Scriptless Social Sharing <= 3.2.4 - Cross Site Scripting (XSS) Vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robin Cornett Scriptless Social Sharing allows Stored XSS. This issue affects Scriptless Social Sharing: from n/a through 3.2.4. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39528	WordPress Rescue Shortcodes plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rescue Themes Rescue Shortcodes allows Stored XSS. This issue affects Rescue Shortcodes: from n/a through 3.1. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39525	WordPress Logo Carousel Slider <= 2.1.3 - Cross Site Scripting (XSS) Vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Logo Carousel Slider allows Stored XSS. This issue affects Logo Carousel Slider: from n/a through 2.1.3. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39524	WordPress Html5 Audio Player <= 2.2.28 - Cross Site Scripting (XSS) Vulnerability Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in bPlugins Html5 Audio Player allows Stored XSS. This issue affects Html5 Audio Player: from n/a through 2.2.28. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE April 16th, 2025 (about 2 months ago)
CVE-2025-39522	WordPress Dynamic Post <= 4.10 - Settings Change Vulnerability Description: Missing Authorization vulnerability in Sebastian Lee Dynamic Post allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Dynamic Post: from n/a through 4.10. CVSS: MEDIUM (5.4) EPSS Score: 0.04% Source: CVE April 16th, 2025 (about 2 months ago)