CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

Example Searches:

CVE-2025-49068	WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP Ocean Extra allows Stored XSS.This issue affects Ocean Extra: from n/a through 2.4.8. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-49067	WordPress Nasa Core plugin < 6.4.1 - Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core allows Stored XSS.This issue affects Nasa Core: from n/a before 6.4.1. CVSS: MEDIUM (6.5) EPSS Score: 0.03% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-48337	WordPress QuickCab plugin <= 1.3.3 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in QuickcabWP QuickCab.This issue affects QuickCab: from n/a through 1.3.3. CVSS: MEDIUM (5.3) EPSS Score: 0.04% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-48335	WordPress Responsive Plus plugin <= 3.2.0 - Broken Access Control vulnerability Description: Missing Authorization vulnerability in CyberChimps Responsive Plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through 3.2.0. CVSS: MEDIUM (5.4) EPSS Score: 0.04% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-48329	WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Reflected Cross Site Scripting (XSS) vulnerability Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daman Jeet Real Time Validation for Gravity Forms allows Reflected XSS.This issue affects Real Time Validation for Gravity Forms: from n/a through 1.7.0. CVSS: HIGH (7.1) EPSS Score: 0.04% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-48328	WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability Description: Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through 1.7.0. CVSS: MEDIUM (4.3) EPSS Score: 0.02% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-47586	WordPress Motors - Events plugin <= 1.4.7 - Unauthenticated Local File Inclusion vulnerability Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events allows PHP Local File Inclusion.This issue affects Motors - Events: from n/a through 1.4.7. CVSS: CRITICAL (9.0) EPSS Score: 0.15% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-47584	WordPress Photography theme <= 7.5.2 - PHP Object Injection vulnerability Description: Deserialization of Untrusted Data vulnerability in ThemeGoods Photography.This issue affects Photography: from n/a through 7.5.2. CVSS: HIGH (8.5) EPSS Score: 0.05% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41367	Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF Description: Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission. CVSS: MEDIUM (4.8) EPSS Score: 0.05% Source: CVE June 6th, 2025 (about 1 month ago)
CVE-2025-41366	CORS vulnerability in IDF and ZLF Description: In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with permissions higher than the view permission. CVSS: MEDIUM (5.1) EPSS Score: 0.04% Source: CVE June 6th, 2025 (about 1 month ago)