Mon, Sep 22 · 07:16 PM CDTCVE-2025-58255
9.6/10 · Must read/watchNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in yonisink Custom Post Type Images custom-post-types-image allows Code Injection.This issue affects Custom Post Type Images: from n/a through <= 0.5.
CVECVE-2025-58255
SeverityCRITICAL
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58244
8.8/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Anps Constructo constructo allows Object Injection.This issue affects Constructo: from n/a through <= 4.3.9.
CVECVE-2025-58244
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58250
8.8/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo fingo allows Authentication Bypass.This issue affects Findgo: from n/a through <= 1.3.55.
CVECVE-2025-58250
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58686
8.5/10 · Worth your timeNVDvuln
Summary
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quadlayers Perfect Brands for WooCommerce perfect-woocommerce-brands allows SQL Injection.This issue affects Perfect Brands for WooCommerce: from n/a through <= 3.6.2.
CVECVE-2025-58686
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58973
7.5/10 · Worth your timeNVDvuln
Summary
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows PHP Local File Inclusion.This issue affects Easy Elementor Addons: from n/a through <= 2.2.8.
CVECVE-2025-58973
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58662
7.2/10 · Worth your timeNVDvuln
Summary
Deserialization of Untrusted Data vulnerability in awesomesupport Awesome Support awesome-support allows Object Injection.This issue affects Awesome Support: from n/a through <= 6.3.5.
CVECVE-2025-58662
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58259
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in scriptsbundle Nokri nokri allows Cross Site Request Forgery.This issue affects Nokri: from n/a through <= 1.6.4.
CVECVE-2025-58259
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58261
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc Mavis HTTPS to HTTP Redirection mavis-https-to-http-redirect allows Stored XSS.This issue affects Mavis HTTPS to HTTP Redirection: from n/a through <= 1.4.3.
CVECVE-2025-58261
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58262
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in WPDirectoryKit Sweet Energy Efficiency sweet-energy-efficiency allows Stored XSS.This issue affects Sweet Energy Efficiency: from n/a through <= 1.0.8.
CVECVE-2025-58262
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58267
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Aftabul Islam Stock Message stock-message allows Stored XSS.This issue affects Stock Message: from n/a through <= 1.1.0.
CVECVE-2025-58267
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58268
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in WPMK WPMK PDF Generator wpmk-pdf-generator allows Stored XSS.This issue affects WPMK PDF Generator: from n/a through <= 1.0.1.
CVECVE-2025-58268
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58270
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in NIX Solutions Ltd NIX Anti-Spam Light nix-anti-spam-light allows Cross Site Request Forgery.This issue affects NIX Anti-Spam Light: from n/a through <= 0.0.4.
CVECVE-2025-58270
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58657
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in EdwardBock Grid grid allows Stored XSS.This issue affects Grid: from n/a through <= 2.3.1.
CVECVE-2025-58657
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58670
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Shankaranand Maurya WP Content Protection wp-content-protection allows Stored XSS.This issue affects WP Content Protection: from n/a through <= 1.3.
CVECVE-2025-58670
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58671
7.1/10 · Worth your timeNVDvuln
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in morganrichards Auction Feed auction-feed allows Stored XSS.This issue affects Auction Feed: from n/a through <= 1.1.4.
CVECVE-2025-58671
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58676
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in extendyourweb HORIZONTAL SLIDER horizontal-slider allows Stored XSS.This issue affects HORIZONTAL SLIDER: from n/a through <= 2.4.
CVECVE-2025-58676
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58677
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in puravida1976 ShrinkTheWeb (STW) Website Previews shrinktheweb-website-preview-plugin allows Stored XSS.This issue affects ShrinkTheWeb (STW) Website Previews: from n/a through <= 2.8.5.
CVECVE-2025-58677
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58687
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Current Age Plugin current-age allows Stored XSS.This issue affects Current Age Plugin: from n/a through <= 1.6.
CVECVE-2025-58687
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58688
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in Casengo Casengo Live Chat Support the-casengo-chat-widget allows Stored XSS.This issue affects Casengo Live Chat Support: from n/a through <= 2.1.4.
CVECVE-2025-58688
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58690
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in ptibogxiv Doliconnect doliconnect allows Stored XSS.This issue affects Doliconnect: from n/a through <= 9.5.7.
CVECVE-2025-58690
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58956
7.1/10 · Worth your timeNVDvuln
Summary
Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System wp-attractive-donations-system-easy-stripe-paypal-donations allows Stored XSS.This issue affects WP Attractive Donations System: from n/a through < 1.29.
CVECVE-2025-58956
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58017
6.5/10 · Skim only if relevantNVDvuln
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Stored XSS.This issue affects Ultimate Store Kit Elementor Addons: from n/a through <= 2.8.6.
CVECVE-2025-58017
SeverityMEDIUM
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58018
6.5/10 · Skim only if relevantNVDvuln
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Leishman Mail Subscribe List mail-subscribe-list allows Stored XSS.This issue affects Mail Subscribe List: from n/a through <= 2.1.10.
CVECVE-2025-58018
SeverityMEDIUM
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58019
6.5/10 · Skim only if relevantNVDvuln
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Search Atlas Group Search Atlas SEO metasync allows Stored XSS.This issue affects Search Atlas SEO: from n/a through <= 2.5.4.
CVECVE-2025-58019
SeverityMEDIUM
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
CVE-2025-58020
6.5/10 · Skim only if relevantNVDvuln
Summary
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeroen Schmit Theater for WordPress theatre allows Stored XSS.This issue affects Theater for WordPress: from n/a through <= 0.18.8.
CVECVE-2025-58020
SeverityMEDIUM
TypeUPDATED
PublishedMon, Sep 22 · 07:16 PM CDT
ModifiedSun, Oct 11 · 09:10 PM CDT
