CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-22535	WordPress WPListCal Plugin <= 1.3.5 - SQL Injection vulnerability Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jonathan Kern WPListCal allows SQL Injection.This issue affects WPListCal: from n/a through 1.3.5. CVSS: HIGH (8.5) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22527	WordPress Mailing Group Listserv Plugin <= 2.0.9 - SQL Injection vulnerability Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through 2.0.9. CVSS: HIGH (7.6) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22521	WordPress wp Hosting Performance Check Plugin <= 2.18.8 - Reflected Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Scott Farrell wp Hosting Performance Check allows Reflected XSS.This issue affects wp Hosting Performance Check: from n/a through 2.18.8. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22510	WordPress WC Price History for Omnibus plugin <= 2.1.4 - PHP Object Injection vulnerability Description: Deserialization of Untrusted Data vulnerability in Konrad Karpieszuk WC Price History for Omnibus allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through 2.1.4. CVSS: HIGH (7.2) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22508	WordPress FAT Event Lite plugin <= 1.1 - Unauthenticated Non-Arbitrary Local File Inclusion vulnerability Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roninwp FAT Event Lite allows PHP Local File Inclusion.This issue affects FAT Event Lite: from n/a through 1.1. CVSS: HIGH (8.1) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22505	WordPress NC Wishlist for Woocommerce Plugin <= 1.0.1 - SQL Injection vulnerability Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Nabaraj Chapagain NC Wishlist for Woocommerce allows SQL Injection.This issue affects NC Wishlist for Woocommerce: from n/a through 1.0.1. CVSS: HIGH (8.5) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22504	WordPress 4ECPS Web Forms Plugin <= 0.2.18 - Arbitrary File Upload vulnerability Description: Unrestricted Upload of File with Dangerous Type vulnerability in jumpdemand 4ECPS Web Forms allows Upload a Web Shell to a Web Server.This issue affects 4ECPS Web Forms: from n/a through 0.2.18. CVSS: CRITICAL (10.0) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22449	Access control flaw for team admins allows unauthorized team additions Description: Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the "allow_open_invite" field via making their team public. CVSS: LOW (3.8) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22445	Misleading UI for undefined admin console settings in Calls causes security confusion Description: Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting. CVSS: LOW (3.5) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)
CVE-2025-22361	WordPress Opentracker Analytics Plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Opentracker Opentracker Analytics allows Reflected XSS.This issue affects Opentracker Analytics: from n/a through 1.3. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE January 10th, 2025 (6 months ago)