2025 CVE Vulnerabilities
45,331 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-53523 | MEDIUM | 5.4 | 0.1% | Dec 12, 2025 | Stored cross-site scripting vulnerabilities exist in GroupSession Free edition prior to ver5.3.0, GroupSession byCloud p... |
| CVE-2025-14467 | MEDIUM | 4.4 | 0.2% | Dec 12, 2025 | The WP Job Portal plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including... |
| CVE-2025-14393 | MEDIUM | 6.4 | 0.2% | Dec 12, 2025 | The Wpik WordPress Basic Ajax Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dname' par... |
| CVE-2025-14392 | MEDIUM | 4.3 | 0.2% | Dec 12, 2025 | The Simple Theme Changer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi... |
| CVE-2025-14391 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The Simple Theme Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includi... |
| CVE-2025-14354 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The Resource Library for Logged In Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all version... |
| CVE-2025-14344 | CRITICAL | 9.8 | 0.5% | Dec 12, 2025 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f... |
| CVE-2025-14170 | MEDIUM | 4.3 | 0.2% | Dec 12, 2025 | The Vimeo SimpleGallery plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including... |
| CVE-2025-14166 | MEDIUM | 5.3 | 0.4% | Dec 12, 2025 | The WPMasterToolKit plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 2.13.... |
| CVE-2025-14165 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The Kirim.Email WooCommerce Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions... |
| CVE-2025-14162 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The BMLT WordPress Plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including... |
| CVE-2025-14161 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The Truefy Embed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, ... |
| CVE-2025-14160 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The Upcoming for Calendly plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in... |
| CVE-2025-14158 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The Coding Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including,... |
| CVE-2025-14143 | MEDIUM | 6.4 | 0.2% | Dec 12, 2025 | The Ayo Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' parameter of the ay... |
| CVE-2025-14138 | MEDIUM | 6.1 | 0.2% | Dec 12, 2025 | The WPLG Default Mail From plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_S... |
| CVE-2025-14137 | MEDIUM | 6.1 | 0.3% | Dec 12, 2025 | The Simple AL Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']`... |
| CVE-2025-14132 | MEDIUM | 6.1 | 0.2% | Dec 12, 2025 | The Category Dropdown List plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_S... |
| CVE-2025-14129 | MEDIUM | 6.1 | 0.2% | Dec 12, 2025 | The Like DisLike Voting plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF... |
| CVE-2025-14125 | MEDIUM | 6.1 | 0.2% | Dec 12, 2025 | The Complag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable... |
| CVE-2025-14119 | MEDIUM | 6.4 | 0.2% | Dec 12, 2025 | The App Landing Template Blocks for WPBakery (Visual Composer) Page Builder plugin for WordPress is vulnerable to Stored... |
| CVE-2025-14064 | MEDIUM | 5.4 | 0.2% | Dec 12, 2025 | The BuddyTask plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capabi... |
| CVE-2025-14062 | MEDIUM | 4.3 | 0.1% | Dec 12, 2025 | The Animated Pixel Marquee Creator plugin for WordPress is vulnerable to Cross-Site Request Forgery via the 'marquee' pa... |
| CVE-2025-14048 | MEDIUM | 4.4 | 0.2% | Dec 12, 2025 | The SimplyConvert plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'simplyconvert_hash' option ... |
| CVE-2025-14045 | MEDIUM | 4.3 | 0.2% | Dec 12, 2025 | The URL Media Uploader plugin for WordPress is vulnerable to unauthorized safe file uploads due to a missing capability ... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now