2025 CVE Vulnerabilities
45,522 CVEs published in 2025.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2025-31962 | MEDIUM | 4.3 | 0.2% | Jan 7, 2026 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authentic... |
| CVE-2025-15474 | MEDIUM | 5.3 | 0.3% | Jan 7, 2026 | AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticate... |
| CVE-2025-15058 | MEDIUM | 6.4 | 0.3% | Jan 7, 2026 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' ... |
| CVE-2025-15000 | MEDIUM | 4.4 | 0.2% | Jan 7, 2026 | The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all vers... |
| CVE-2025-14999 | MEDIUM | 4.3 | 0.1% | Jan 7, 2026 | The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1... |
| CVE-2025-14904 | MEDIUM | 4.3 | 0.1% | Jan 7, 2026 | The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and i... |
| CVE-2025-14901 | MEDIUM | 6.5 | 0.4% | Jan 7, 2026 | The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing ... |
| CVE-2025-14891 | MEDIUM | 6.4 | 0.3% | Jan 7, 2026 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayN... |
| CVE-2025-14888 | MEDIUM | 4.4 | 0.2% | Jan 7, 2026 | The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value fi... |
| CVE-2025-14887 | MEDIUM | 4.4 | 0.2% | Jan 7, 2026 | The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting... |
| CVE-2025-14875 | MEDIUM | 6.1 | 0.2% | Jan 7, 2026 | The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ... |
| CVE-2025-14867 | MEDIUM | 6.5 | 0.4% | Jan 7, 2026 | The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'so... |
| CVE-2025-14845 | MEDIUM | 4.3 | 0.2% | Jan 7, 2026 | The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up... |
| CVE-2025-14842 | MEDIUM | 6.1 | 0.4% | Jan 7, 2026 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files wi... |
| CVE-2025-14802 | MEDIUM | 5.4 | 0.3% | Jan 7, 2026 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and i... |
| CVE-2025-14796 | MEDIUM | 6.4 | 0.3% | Jan 7, 2026 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image titles in all versions ... |
| CVE-2025-14792 | MEDIUM | 4.4 | 0.2% | Jan 7, 2026 | The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_... |
| CVE-2025-14719 | MEDIUM | 4.9 | 0.2% | Jan 7, 2026 | The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and es... |
| CVE-2025-14631 | MEDIUM | 6.5 | 0.2% | Jan 7, 2026 | A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cau... |
| CVE-2025-14626 | MEDIUM | 6.4 | 0.2% | Jan 7, 2026 | The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross... |
| CVE-2025-14625 | MEDIUM | 6.7 | 0.1% | Jan 7, 2026 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell module... |
| CVE-2025-14614 | MEDIUM | 6.7 | 0.1% | Jan 7, 2026 | Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Pr... |
| CVE-2025-14468 | MEDIUM | 4.3 | 0.1% | Jan 7, 2026 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions u... |
| CVE-2025-14465 | MEDIUM | 4.3 | 0.1% | Jan 7, 2026 | The Sticky Action Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and in... |
| CVE-2025-14460 | MEDIUM | 5.3 | 0.4% | Jan 7, 2026 | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modificatio... |
Check if your code is affected by 2025 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now