Skip to content
OpenAdvisories

Archive

7 January 2025

Vulnerabilities first published on this day (UTC), newest first.

← December 2024 2025 / January /7 February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

350 results · Feed

  • Medium 6.5
    CVE-2025-22544

    WordPress Mind Doodle Visual Sitemaps & Tasks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mind Doodle Mind Doodle Visual Sitemaps & Tasks mind-doodle-sitemap allows Stored XSS.This issue affects Mind Doodle Visual Sitemaps & Tasks: from n/a throug…

    Mind Doodle Mind Doodle Visual Sitemaps & Tasks
  • Medium 5.4
    CVE-2025-22543

    WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerability

    Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through <= 1.0.8.

    beautifultemplates ST Gallery WP
  • Medium 6.5
    CVE-2025-22546

    WordPress jQuery TwentyTwenty plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.

    Obaid Hossain jQuery TwentyTwenty
  • Medium 6.5
    CVE-2025-22545

    WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through <= 1.2.

    sw.galati iframe to embed
  • High 7.1
    CVE-2025-22547

    WordPress JK Html To Pdf plugin <= 1.0.0 - CSRF to Stored XSS vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jaykrishnang JK Html To Pdf jk-html-to-pdf allows Stored XSS.This issue affects JK Html To Pdf: from n/a through <= 1.0.0.

    jaykrishnang JK Html To Pdf
  • Medium 6.5
    CVE-2025-22549

    WordPress WP Github plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seinoxygen WP Github wp-github allows Stored XSS.This issue affects WP Github: from n/a through <= 1.3.3.

    seinoxygen WP Github
  • High 7.1
    CVE-2025-22548

    WordPress ldap_login_password_and_role_manager plugin <= 1.0.12 - CSRF to Stored XSS vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in frankkoenen ldap_login_password_and_role_manager ldap-login-password-and-role-manager allows Stored XSS.This issue affects ldap_login_password_and_role_manag…

    frankkoenen ldap_login_password_and_role_manager
  • Medium 6.5
    CVE-2025-22550

    WordPress AddFunc Mobile Detect plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Rhoney AddFunc Mobile Detect addfunc-mobile-detect allows Stored XSS.This issue affects AddFunc Mobile Detect: from n/a through <= 3.1.

    Joe Rhoney AddFunc Mobile Detect
  • Medium 6.5
    CVE-2025-22551

    WordPress Boot-Modal plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in albedo0 Boot-Modal boot-modal allows Stored XSS.This issue affects Boot-Modal: from n/a through <= 1.9.1.

    albedo0 Boot-Modal
  • High 7.1
    CVE-2025-22552

    WordPress Affiliate Disclosure Statement plugin <= 0.3 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Affiliate Disclosure Statement affiliate-disclosure-statement allows Cross Site Request Forgery.This issue affects Affiliate Disclosure Statement: from n/a through <= 0.3.

    bnielsen Affiliate Disclosure Statement
  • Medium 6.5
    CVE-2025-22554

    WordPress Video Embed Optimizer plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fdfranklin06 Video Embed Optimizer video-embed-optimizer allows Stored XSS.This issue affects Video Embed Optimizer: from n/a through <= 1.0.0.

    fdfranklin06 Video Embed Optimizer
  • High 7.1
    CVE-2025-22555

    WordPress Smoothness Slider Shortcode plugin <= v1.2.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in njshofe Smoothness Slider Shortcode smoothness-slider-shortcode allows Cross Site Request Forgery.This issue affects Smoothness Slider Shortcode: from n/a through <= v1.2.2.

    njshofe Smoothness Slider Shortcode
  • High 7.1
    CVE-2025-22556

    WordPress Norse Rune Oracle plugin <= 1.4.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle allows Cross Site Request Forgery.This issue affects Norse Rune Oracle Plugin: from n/a through <= 1.4.2.

    WP CMS Ninja Norse Rune Oracle Plugin
  • High 7.1
    CVE-2025-22557

    WordPress News Publisher Autopilot plugin <= 2.1.4 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in cdowp News Publisher Autopilot wpm-news-api allows Cross Site Request Forgery.This issue affects News Publisher Autopilot: from n/a through <= 2.1.4.

    cdowp News Publisher Autopilot
  • Medium 6.5
    CVE-2025-22558

    WordPress mcjh button shortcode plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus C. J. Hartmann mcjh button shortcode mcjh-button-shortcode allows Stored XSS.This issue affects mcjh button shortcode: from n/a through <= 1.6.4.

    Marcus C. J. Hartmann mcjh button shortcode
  • High 7.1
    CVE-2025-22559

    WordPress TubePress.NET Plugin <= 4.0.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in tubepress TubePress.NET tubepressnet allows Cross Site Request Forgery.This issue affects TubePress.NET: from n/a through <= 4.0.1.

    tubepress TubePress.NET
  • Medium 4.3
    CVE-2025-22562

    WordPress Title Experiments Free plugin <= 9.0.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in kbowson Title Experiments Free wp-experiments-free allows Cross Site Request Forgery.This issue affects Title Experiments Free: from n/a through <= 9.0.4.

    kbowson Title Experiments Free
  • Medium 5.3
    CVE-2025-22560

    WordPress Saoshyant Page Builder plugin <= 3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in saoshyant1994 Saoshyant Page Builder saoshyant-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Saoshyant Page Builder: from n/a through <= 3.8.

    saoshyant1994 Saoshyant Page Builder
  • Medium 4.3
    CVE-2025-22563

    WordPress Pretty Urls Plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in faaiq Pretty Url pretty-url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through <= 1.5.5.

    faaiq Pretty Url
  • High 7.1
    CVE-2025-22571

    WordPress Instabot plugin <= 1.10 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in instabot Instabot instabot allows Cross Site Request Forgery.This issue affects Instabot: from n/a through <= 1.10.

    instabot Instabot
  • Medium 6.5
    CVE-2025-22572

    WordPress Legacy ePlayer plugin <= 0.9.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Legacy ePlayer sportspress-tv allows Stored XSS.This issue affects Legacy ePlayer: from n/a through <= 0.9.9.

    Brian Legacy ePlayer
  • Medium 6.5
    CVE-2025-22573

    WordPress Icons Enricher plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher icons-enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through <= 1.0.8.

    copist Icons Enricher
  • Medium 6.5
    CVE-2025-22574

    WordPress ICS Button plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleanshooter ICS Button ics-button allows Stored XSS.This issue affects ICS Button: from n/a through <= 0.6.

    Cleanshooter ICS Button
  • Medium 6.5
    CVE-2025-22577

    WordPress Able Player plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damion Armentrout Able Player wp-able-player allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.0.

    Damion Armentrout Able Player
  • Medium 5.9
    CVE-2025-22579

    WordPress WP Header Notification plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through <= 1.2.7.

    Arefly WP Header Notification
  • Medium 5.9
    CVE-2025-22578

    WordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through <= 1.0.0.

    aazztech WP Cookie
  • Medium 6.5
    CVE-2025-22580

    WordPress Biltorvet Dealer Tools plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Auto IT Biltorvet Dealer Tools biltorvet-dealer-tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through <= 1.0.22.

    Auto IT Biltorvet Dealer Tools
  • High 7.1
    CVE-2025-22582

    WordPress Uptime Robot plugin <= 0.1.3 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Scott Nelle Uptime Robot uptime-robot allows Stored XSS.This issue affects Uptime Robot: from n/a through <= 0.1.3.

    Scott Nelle Uptime Robot
  • Medium 6.5
    CVE-2025-22581

    WordPress Arcade Ready plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready arcadeready allows Stored XSS.This issue affects Arcade Ready: from n/a through <= 1.1.

    Bytephp Arcade Ready
  • Medium 6.5
    CVE-2025-22585

    WordPress Ultimate Image Hover Effects plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through <= …

    themebon Ultimate Image Hover Effects
  • Medium 6.5
    CVE-2025-22584

    WordPress Timeline Pro plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Timeline Pro timeline-pro allows DOM-Based XSS.This issue affects Timeline Pro: from n/a through <= 1.3.

    PluginsPoint Timeline Pro
  • High 7.1
    CVE-2025-22589

    WordPress Quote Tweet plugin <= 0.7 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bozdoz Quote Tweet quote-tweet allows Stored XSS.This issue affects Quote Tweet: from n/a through <= 0.7.

    bozdoz Quote Tweet
  • High 7.1
    CVE-2025-22590

    WordPress Prayer Times Anywhere plugin <= 2.0.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in mmrs151 Prayer Times Anywhere prayer-times-anywhere allows Stored XSS.This issue affects Prayer Times Anywhere: from n/a through <= 2.0.1.

    mmrs151 Prayer Times Anywhere
  • Medium 4.3
    CVE-2025-22591

    WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability

    Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.

    8blocks 1003 Mortgage Application
  • High 7.5
    CVE-2025-22592

    WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability

    Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.

    8blocks 1003 Mortgage Application
  • High 7.1
    CVE-2025-22593

    WordPress Laika Pedigree Tree plugin <= 1.4 - CSRF to Stored XSS vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in burria Laika Pedigree Tree laika-pedigree-tree allows Stored XSS.This issue affects Laika Pedigree Tree: from n/a through <= 1.4.

    burria Laika Pedigree Tree
  • Medium 6.9
    CVE-2024-11681

    Remote Code Execution in MacPorts

    A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror.

    MacPorts MacPorts
  • Medium 6.3
    CVE-2025-0296

    code-projects Online Book Shop booklist.php sql injection

    A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attac…

    code-projects Online Book Shop
  • Low 3.5
    CVE-2025-0295

    code-projects Online Book Shop booklist.php cross site scripting

    A vulnerability was found in code-projects Online Book Shop 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /booklist.php?subcatid=1. The manipulation of the argument subcatnm leads to cross site scripting. …

    code-projects Online Book Shop
  • Medium 4.7
    CVE-2025-0294

    SourceCodester Home Clean Services Management System process.php sql injection

    A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /public_html/admin/process.php. The manipulation of the argument type…

    SourceCodester Home Clean Services Management System