Skip to content
OpenAdvisories

Archive

January 2025

Vulnerabilities first published in this month (UTC), newest first.

← December 2024 2025 / January February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

2,209 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-22515

    WordPress Show Google Analytics widget plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Simon Show Google Analytics widget show-google-analytics-widget allows Stored XSS.This issue affects Show Google Analytics widget: from n/a through <= 1.5.4.

    Simon Show Google Analytics widget
  • Medium 6.5
    CVE-2025-22517

    WordPress List Pages at Depth plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson List Pages at Depth list-pages-at-depth allows Stored XSS.This issue affects List Pages at Depth: from n/a through <= 1.5.

    Ben Huson List Pages at Depth
  • Medium 6.5
    CVE-2025-22518

    WordPress Justified Image Gallery plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Justified Image Gallery justified-image-gallery allows Stored XSS.This issue affects Justified Image Gallery: from n/a through <= 1.0.

    PluginsPoint Justified Image Gallery
  • Medium 6.5
    CVE-2025-22524

    WordPress فرم ساز فرم افزار Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in formafzar فرم ساز فرم افزار formafzar allows Stored XSS.This issue affects فرم ساز فرم افزار: from n/a through <= 2.0.

    formafzar
  • Medium 6.5
    CVE-2025-22525

    WordPress Donation Block For PayPal Plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bharat Kambariya Donation Block For PayPal donations-block allows Stored XSS.This issue affects Donation Block For PayPal: from n/a through <= 2.2.0.

    Bharat Kambariya Donation Block For PayPal
  • Medium 6.5
    CVE-2025-22528

    WordPress Huurkalender WP Plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Huurkalender.nl Huurkalender WP huurkalender-wp allows Stored XSS.This issue affects Huurkalender WP: from n/a through <= 1.5.6.

    Huurkalender.nl Huurkalender WP
  • Medium 6.5
    CVE-2025-22529

    WordPress WE Blocks <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordpresteem WE Blocks we-blocks allows Stored XSS.This issue affects WE Blocks: from n/a through <= 1.3.5.

    wordpresteem WE Blocks
  • Medium 6.5
    CVE-2025-22531

    WordPress Urdu Formatter – Shamil plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M Bilal M Urdu Formatter – Shamil urdu-formatter-shamil allows Stored XSS.This issue affects Urdu Formatter – Shamil: from n/a through <= 0.1.

    M Bilal M Urdu Formatter – Shamil
  • Medium 6.5
    CVE-2025-22530

    WordPress 아임포트 결제버튼 생성 플러그인 plugin <= 1.1.19 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PORTONE 아임포트 결제버튼 생성 플러그인 iamport-payment allows Stored XSS.This issue affects 아임포트 결제버튼 생성 플러그인: from n/a through <= 1.1.19.

    PORTONE
  • Medium 6.5
    CVE-2025-22532

    WordPress Simple Photo Sphere plugin <= 0.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Simple Photo Sphere simple-photo-sphere allows Stored XSS.This issue affects Simple Photo Sphere: from n/a through <= 0.0.10.

    snagysandor Simple Photo Sphere
  • Medium 5.4
    CVE-2025-22534

    WordPress Slides & Presentations Plugin <= 0.0.39 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ella Van Durpe Slides & Presentations slide allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slides & Presentations: from n/a through <= 0.0.39.

    Ella Van Durpe Slides & Presentations
  • Medium 5.4
    CVE-2025-22541

    WordPress WP Delete Post Copies plugin <= 5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in etruel WP Delete Post Copies etruel-del-post-copies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delete Post Copies: from n/a through <= 5.5.

    etruel WP Delete Post Copies
  • Medium 6.5
    CVE-2025-22544

    WordPress Mind Doodle Visual Sitemaps & Tasks plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mind Doodle Mind Doodle Visual Sitemaps & Tasks mind-doodle-sitemap allows Stored XSS.This issue affects Mind Doodle Visual Sitemaps & Tasks: from n/a throug…

    Mind Doodle Mind Doodle Visual Sitemaps & Tasks
  • Medium 5.4
    CVE-2025-22543

    WordPress ST Gallery WP plugin <= 1.0.8 - Settings Change vulnerability

    Missing Authorization vulnerability in beautifultemplates ST Gallery WP st-gallery-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ST Gallery WP: from n/a through <= 1.0.8.

    beautifultemplates ST Gallery WP
  • Medium 6.5
    CVE-2025-22546

    WordPress jQuery TwentyTwenty plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Obaid Hossain jQuery TwentyTwenty js-twentytwenty allows Stored XSS.This issue affects jQuery TwentyTwenty: from n/a through <= 1.0.

    Obaid Hossain jQuery TwentyTwenty
  • Medium 6.5
    CVE-2025-22545

    WordPress iframe to embed plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sw.galati iframe to embed iframe-to-embed allows Stored XSS.This issue affects iframe to embed: from n/a through <= 1.2.

    sw.galati iframe to embed
  • Medium 6.5
    CVE-2025-22549

    WordPress WP Github plugin <= 1.3.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seinoxygen WP Github wp-github allows Stored XSS.This issue affects WP Github: from n/a through <= 1.3.3.

    seinoxygen WP Github
  • Medium 6.5
    CVE-2025-22550

    WordPress AddFunc Mobile Detect plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Joe Rhoney AddFunc Mobile Detect addfunc-mobile-detect allows Stored XSS.This issue affects AddFunc Mobile Detect: from n/a through <= 3.1.

    Joe Rhoney AddFunc Mobile Detect
  • Medium 6.5
    CVE-2025-22551

    WordPress Boot-Modal plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in albedo0 Boot-Modal boot-modal allows Stored XSS.This issue affects Boot-Modal: from n/a through <= 1.9.1.

    albedo0 Boot-Modal
  • Medium 6.5
    CVE-2025-22554

    WordPress Video Embed Optimizer plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fdfranklin06 Video Embed Optimizer video-embed-optimizer allows Stored XSS.This issue affects Video Embed Optimizer: from n/a through <= 1.0.0.

    fdfranklin06 Video Embed Optimizer
  • Medium 6.5
    CVE-2025-22558

    WordPress mcjh button shortcode plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus C. J. Hartmann mcjh button shortcode mcjh-button-shortcode allows Stored XSS.This issue affects mcjh button shortcode: from n/a through <= 1.6.4.

    Marcus C. J. Hartmann mcjh button shortcode
  • Medium 4.3
    CVE-2025-22562

    WordPress Title Experiments Free plugin <= 9.0.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in kbowson Title Experiments Free wp-experiments-free allows Cross Site Request Forgery.This issue affects Title Experiments Free: from n/a through <= 9.0.4.

    kbowson Title Experiments Free
  • Medium 5.3
    CVE-2025-22560

    WordPress Saoshyant Page Builder plugin <= 3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in saoshyant1994 Saoshyant Page Builder saoshyant-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Saoshyant Page Builder: from n/a through <= 3.8.

    saoshyant1994 Saoshyant Page Builder
  • Medium 4.3
    CVE-2025-22563

    WordPress Pretty Urls Plugin <= 1.5.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in faaiq Pretty Url pretty-url allows Cross Site Request Forgery.This issue affects Pretty Url: from n/a through <= 1.5.5.

    faaiq Pretty Url
  • Medium 6.5
    CVE-2025-22572

    WordPress Legacy ePlayer plugin <= 0.9.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brian Legacy ePlayer sportspress-tv allows Stored XSS.This issue affects Legacy ePlayer: from n/a through <= 0.9.9.

    Brian Legacy ePlayer
  • Medium 6.5
    CVE-2025-22573

    WordPress Icons Enricher plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in copist Icons Enricher icons-enricher allows Stored XSS.This issue affects Icons Enricher: from n/a through <= 1.0.8.

    copist Icons Enricher
  • Medium 6.5
    CVE-2025-22574

    WordPress ICS Button plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cleanshooter ICS Button ics-button allows Stored XSS.This issue affects ICS Button: from n/a through <= 0.6.

    Cleanshooter ICS Button
  • Medium 6.5
    CVE-2025-22577

    WordPress Able Player plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damion Armentrout Able Player wp-able-player allows DOM-Based XSS.This issue affects Able Player: from n/a through <= 1.0.

    Damion Armentrout Able Player
  • Medium 5.9
    CVE-2025-22579

    WordPress WP Header Notification plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arefly WP Header Notification wp-header-notification allows Stored XSS.This issue affects WP Header Notification: from n/a through <= 1.2.7.

    Arefly WP Header Notification
  • Medium 5.9
    CVE-2025-22578

    WordPress WP Cookie plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aazztech WP Cookie wp-cookie allows Stored XSS.This issue affects WP Cookie: from n/a through <= 1.0.0.

    aazztech WP Cookie
  • Medium 6.5
    CVE-2025-22580

    WordPress Biltorvet Dealer Tools plugin <= 1.0.22 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Auto IT Biltorvet Dealer Tools biltorvet-dealer-tools allows Stored XSS.This issue affects Biltorvet Dealer Tools: from n/a through <= 1.0.22.

    Auto IT Biltorvet Dealer Tools
  • Medium 6.5
    CVE-2025-22581

    WordPress Arcade Ready plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bytephp Arcade Ready arcadeready allows Stored XSS.This issue affects Arcade Ready: from n/a through <= 1.1.

    Bytephp Arcade Ready
  • Medium 6.5
    CVE-2025-22585

    WordPress Ultimate Image Hover Effects plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Ultimate Image Hover Effects ultimate-image-hover-effects allows DOM-Based XSS.This issue affects Ultimate Image Hover Effects: from n/a through <= …

    themebon Ultimate Image Hover Effects
  • Medium 6.5
    CVE-2025-22584

    WordPress Timeline Pro plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginsPoint Timeline Pro timeline-pro allows DOM-Based XSS.This issue affects Timeline Pro: from n/a through <= 1.3.

    PluginsPoint Timeline Pro
  • Medium 4.3
    CVE-2025-22591

    WordPress 1003 Mortgage Application plugin <= 1.87 - Broken Access Control vulnerability

    Missing Authorization vulnerability in 8blocks 1003 Mortgage Application 1003-mortgage-application allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 1003 Mortgage Application: from n/a through <= 1.87.

    8blocks 1003 Mortgage Application
  • Medium 6.9
    CVE-2024-11681

    Remote Code Execution in MacPorts

    A malicious or compromised MacPorts mirror can execute arbitrary commands as root on the machine of a client running port selfupdate against the mirror.

    MacPorts MacPorts
  • Medium 6.3
    CVE-2025-0296

    code-projects Online Book Shop booklist.php sql injection

    A vulnerability was found in code-projects Online Book Shop 1.0. It has been classified as critical. This affects an unknown part of the file /booklist.php. The manipulation of the argument subcatid leads to sql injection. It is possible to initiate the attac…

    code-projects Online Book Shop
  • Medium 4.7
    CVE-2025-0294

    SourceCodester Home Clean Services Management System process.php sql injection

    A vulnerability has been found in SourceCodester Home Clean Services Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /public_html/admin/process.php. The manipulation of the argument type…

    SourceCodester Home Clean Services Management System
  • Medium 6.1
    CVE-2024-12738

    User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.12.9 - Unauthenticated Stored Cross-Site Scripting

    The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several user meta parameters in all versions up to, and including, 3.12.9 due to insufficient …

    Cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor Web / CMS
  • Medium 4.3
    CVE-2024-12131

    WP Job Portal – A Complete Recruitment System for Company or Job Board website <= 2.2.5- Authenticated (Subscriber+) Insecure Direct Object Reference

    The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.2.5 due to missing validation on a user controlled key. This make…

    WP Job Portal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website Web / CMS