Title	CVE ID	CVSS	Vector	Date
VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Missing Authorization	CVE-2025-5803	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	October 21, 2025
PowerPress Podcasting <= 11.13.12 - Cross-Site Request Forgery	CVE-2025-64201	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	October 21, 2025
CoSchedule <= 3.4.0 - Missing Authorization	CVE-2025-49913	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	November 4, 2025
Hotel Booking <= 2.2.8 - Authenticated (Editor+) Stored Cross-Site Scripting	CVE-2025-63011	4.4	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	November 5, 2025
Hotel Booking <= 2.2.8 - Cross-Site Request Forgery	CVE-2025-63012	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 5, 2025
Hotel Booking <= 2.2.7 - Unauthenticated Information Exposure	CVE-2025-63013	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	November 5, 2025
Feather Login Page <= 1.1.7 - Cross-Site Request Forgery	CVE-2025-62107	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 5, 2025
EventPrime <= 4.2.4.1 - Authenticated (Subscriber+) Information Exposure	CVE-2025-63007	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	November 6, 2025
EventPrime <= 4.2.4.1 - Missing Authorization	CVE-2025-63006	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	November 6, 2025
VikBooking Hotel Booking Engine & PMS <= 1.8.2 - Unauthenticated Information Exposure	CVE-2025-49918	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	November 7, 2025
Ultimate FAQ <= 2.4.3 - Cross-Site Request Forgery	CVE-2025-67590	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 8, 2025
Seriously Simple Podcasting <= 3.13.0 - Unauthenticated Information Exposure	CVE-2025-66059	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	November 9, 2025
Seriously Simple Podcasting <= 3.13.0 - Missing Authorization	CVE-2025-66060	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	November 9, 2025
Restaurant Menu by MotoPress <= 2.4.7 - Authenticated (Subscriber+) Information Exposure	CVE-2025-49914	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N	November 9, 2025
Seriously Simple Podcasting <= 3.13.0 - Cross-Site Request Forgery	CVE-2025-66061	4.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	November 11, 2025
Survey Maker <= 5.1.9.4 - Missing Authorization	CVE-2025-64276	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	November 14, 2025
Appointment Booking Calendar <= 1.3.95 - Missing Authorization	CVE-2025-64261	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	November 15, 2025
Contact Form Email <= 1.3.58 - Missing Authorization	CVE-2025-64369	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	November 15, 2025
RestroPress <= 3.2.3.5 - Missing Authorization	CVE-2025-66100	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	November 17, 2025
wpForo Forum <= 2.4.10 - Missing Authorization	CVE-2025-66070	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N	November 18, 2025

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation