Skip to content
OpenAdvisories

Archive

January 2025

Vulnerabilities first published in this month (UTC), newest first.

← December 2024 2025 / January February 2025 →
  1. 12
  2. 2239
  3. 353
  4. 439
  5. 528
  6. 6106
  7. 7350
  8. 8128
  9. 9267
  10. 1072
  11. 11105
  12. 1213
  13. 13115
  14. 14483
  15. 15204
  16. 16299
  17. 1795
  18. 1835
  19. 1963
  20. 2033
  21. 21283
  22. 22171
  23. 23113
  24. 24199
  25. 2550
  26. 2621
  27. 27243
  28. 28102
  29. 2973
  30. 30156
  31. 31153
All Critical High Medium Low Exploited only Public exploit

4,293 results · Feed

  • Medium 4.3
    CVE-2025-24625

    WordPress Taxonomy/Term and Role based Discounts for WooCommerce plugin <= 5.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

    Missing Authorization vulnerability in Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce taxonomy-discounts-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxonomy/Term and …

    Marco Almeida | Webdados Taxonomy/Term and Role based Discounts for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-24638

    WordPress Create with Code plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pddring Create with Code create-with-code allows DOM-Based XSS.This issue affects Create with Code: from n/a through <= 1.4.

    pddring Create with Code
  • Medium 5.4
    CVE-2025-24652

    WordPress WP Duplicate plugin <= 1.1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in revmakx WP Duplicate local-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Duplicate: from n/a through <= 1.1.6.

    revmakx WP Duplicate
  • Medium 6.5
    CVE-2025-24627

    WordPress Blur Text Plugin <= 1.0.0 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Linnea Huxford Blur Text blur-text allows Stored XSS.This issue affects Blur Text: from n/a through <= 1.0.0.

    Linnea Huxford Blur Text
  • Medium 4.3
    CVE-2025-24613

    WordPress FV Thoughtful Comments plugin <= 0.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in FolioVision FV Thoughtful Comments thoughtful-comments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Thoughtful Comments: from n/a through <= 0.3.5.

    foliovision FV Thoughtful Comments
  • Medium 5.9
    CVE-2025-24634

    WordPress Orbisius Simple Notice plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Svetoslav Marinov Orbisius Simple Notice orbisius-simple-notice allows Stored XSS.This issue affects Orbisius Simple Notice: from n/a through <= 1.1.3.

    Svetoslav Marinov Orbisius Simple Notice
  • Medium 6.5
    CVE-2025-24610

    WordPress Restrict Anonymous Access Plugin <= 1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Christian Leuenberg Restrict Anonymous Access restrict-anonymous-access allows Stored XSS.This issue affects Restrict Anonymous Access: from n/a through <= 1…

    Christian Leuenberg Restrict Anonymous Access
  • Medium 5.4
    CVE-2025-24622

    WordPress Job Board Manager plugin <= 2.1.59 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in PickPlugins Job Board Manager job-board-manager allows Cross Site Request Forgery.This issue affects Job Board Manager: from n/a through <= 2.1.59.

    PickPlugins Job Board Manager
  • Medium 4.3
    CVE-2025-24618

    WordPress ElementInvader Addons for Elementor Plugin <= 1.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementInvader Addons for Elementor: from…

    Element Invader ElementInvader Addons for Elementor
  • High 7.1
    CVE-2025-24636

    WordPress MachForm Shortcode plugin <= 1.4.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rick Laymance MachForm Shortcode machform-shortcode allows Stored XSS.This issue affects MachForm Shortcode: from n/a through <= 1.4.1.

    Rick Laymance MachForm Shortcode
  • Medium 5.3
    CVE-2025-24633

    WordPress Build Private Store For Woocommerce plugin <= 1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Build Private Store For Woocommerce: fro…

    silverplugins217 Build Private Store For Woocommerce Web / CMS
  • Medium 4.9
    CVE-2025-24611

    WordPress Export All Posts, Products, Orders, Refunds & Users Plugin <= 2.9 - Arbitrary File Read vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Smackcoders Inc., WP Ultimate Exporter wp-ultimate-exporter allows Absolute Path Traversal.This issue affects WP Ultimate Exporter: from n/a through <= 2.9.

    Smackcoders WP Ultimate Exporter
  • Medium 5.3
    CVE-2025-24596

    WordPress WooCommerce Product Table Lite plugin <= 3.8.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WC Product Table WooCommerce Product Table Lite wc-product-table-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Product Table Lite: from n/a through <= 3.8.7.

    WC Product Table WooCommerce Product Table Lite Web / CMS
  • Medium 5.4
    CVE-2025-24604

    WordPress VForm plugin <= 3.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Vikas Ratudi VPSUForm v-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VPSUForm: from n/a through <= 3.0.5.

    Vikas Ratudi VPSUForm
  • Medium 6.5
    CVE-2025-24594

    WordPress Linet ERP-Woocommerce Integration plugin <= 3.5.7 - CSRF to Broken Access Control vulnerability

    Missing Authorization vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerce-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Linet ERP-Woocommerce Integration: from n/a through …

    aribhour Linet ERP-Woocommerce Integration Web / CMS
  • High 7.1
    CVE-2025-24562

    WordPress KBucket plugin <= 4.1.6 - CSRF to Stored Cross-Site Scripting vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Optimal Access KBucket kbucket allows Stored XSS.This issue affects KBucket: from n/a through <= 4.1.6.

    Optimal Access KBucket
  • Medium 6.5
    CVE-2025-24595

    WordPress All Embed – Elementor Addons plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins All Embed – Elementor Addons all-embed-addons-for-elementor allows Stored XSS.This issue affects All Embed – Elementor Addons: from n/a through <= 1…

    bPlugins All Embed – Elementor Addons
  • Medium 6.5
    CVE-2025-24572

    WordPress WP Fast Total Search plugin <= 1.78.258 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Cross Site Request Forgery.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.

    Epsiloncool WP Fast Total Search
  • Medium 6.5
    CVE-2025-24588

    WordPress Patreon WordPress plugin <= 1.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in patreon Patreon WordPress patreon-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Patreon WordPress: from n/a through <= 1.9.1.

    Patreon Patreon WordPress Web / CMS
  • Medium 4.3
    CVE-2025-24543

    WordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance ultimate-coming-soon allows Cross Site Request Forgery.This issue affects Ultimate Coming Soon & Maintenance: from n/a through <= 1.0.9.

    RSTheme Ultimate Coming Soon & Maintenance
  • Medium 6.5
    CVE-2025-24573

    WordPress Pagelayer plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softaculous PageLayer pagelayer allows DOM-Based XSS.This issue affects PageLayer: from n/a through <= 1.9.4.

    Softaculous PageLayer
  • Medium 5.3
    CVE-2025-24552

    WordPress Paytium plugin <= 4.4.11 - Full Path Disclosure (FPD) vulnerability

    Generation of Error Message Containing Sensitive Information vulnerability in paytiumsupport Paytium paytium allows Retrieve Embedded Sensitive Data.This issue affects Paytium: from n/a through <= 4.4.11.

    paytiumsupport Paytium
  • Medium 6.5
    CVE-2025-24547

    WordPress Caching Compatible Cookie Opt-In plugin <= 0.0.10 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matthias.wagner Caching Compatible Cookie Opt-In and JavaScript caching-compatible-cookie-optin-and-javascript allows Stored XSS.This issue affects Caching C…

    matthias.wagner Caching Compatible Cookie Opt-In and JavaScript
  • High 7.1
    CVE-2025-24570

    WordPress Atarim plugin <= 4.0.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Stored XSS.This issue affects Atarim: from n/a through <= 4.0.8.

    Vito Peleg Atarim
  • Medium 4.3
    CVE-2025-24589

    WordPress JSM Show Post Metadata plugin <= 4.6.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in JS Morisset JSM Show Post Metadata jsm-show-post-meta allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JSM Show Post Metadata: from n/a through <= 4.6.0.

    JS Morisset JSM Show Post Metadata
  • Medium 5.9
    CVE-2025-24579

    WordPress Nested pages plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Nested Pages wp-nested-pages allows Stored XSS.This issue affects Nested Pages: from n/a through <= 3.2.9.

    Kyle Phillips Nested Pages
  • Medium 6.5
    CVE-2025-24542

    WordPress Icegram Engage plugin <= 3.1.31 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Icegram Icegram icegram allows Stored XSS.This issue affects Icegram: from n/a through <= 3.1.31.

    Icegram Icegram
  • Medium 6.5
    CVE-2025-24585

    WordPress Event post plugin <= 5.9.7 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.9.7.

    Bastien Ho Event post
  • Medium 6.5
    CVE-2025-24578

    WordPress ElementInvader Addons for Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Element Invader ElementInvader Addons for Elementor elementinvader-addons-for-elementor allows DOM-Based XSS.This issue affects ElementInvader Addons for Ele…

    Element Invader ElementInvader Addons for Elementor
  • Medium 4.3
    CVE-2025-24591

    WordPress GDPR CCPA Compliance & Cookie Consent Banner plugin <= 2.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.1.

    Ninja Team GDPR CCPA Compliance Support
  • Medium 5.4
    CVE-2025-24571

    WordPress WP Fast Total Search plugin <= 1.78.258 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Epsiloncool WP Fast Total Search fulltext-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Fast Total Search: from n/a through <= 1.78.258.

    Epsiloncool WP Fast Total Search
  • Medium 5.4
    CVE-2025-24546

    WordPress Ultimate Coming Soon & Maintenance plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in RSTheme Ultimate Coming Soon & Maintenance ultimate-coming-soon allows Cross Site Request Forgery.This issue affects Ultimate Coming Soon & Maintenance: from n/a through <= 1.0.9.

    RSTheme Ultimate Coming Soon & Maintenance
  • Medium 5.3
    CVE-2025-24582 Scanner template

    WordPress 12 Step Meeting List plugin <= 3.16.5 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Retrieve Embedded Sensitive Data.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.

    AA Web Servant 12 Step Meeting List
  • High 7.1
    CVE-2025-24561

    WordPress ReviewsTap plugin <= 1.1.2 - CSRF to Stored Cross-Site Scripting vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in awcode ReviewsTap reviewstap allows Stored XSS.This issue affects ReviewsTap: from n/a through <= 1.1.2.

    awcode ReviewsTap
  • Medium 6.5
    CVE-2025-24575

    WordPress HelloAsso plugin <= 1.1.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HelloAsso HelloAsso helloasso allows Stored XSS.This issue affects HelloAsso: from n/a through <= 1.1.11.

    HelloAsso HelloAsso
  • Medium 6.5
    CVE-2025-24580

    WordPress 12 Step Meeting List plugin <= 3.16.5 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 12 Step Meeting List: from n/a through <= 3.16.5.

    AA Web Servant 12 Step Meeting List
  • Medium 4.3
    CVE-2025-24568

    WordPress Starter Templates plugin <= 4.4.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates astra-sites allows Cross Site Request Forgery.This issue affects Starter Templates: from n/a through <= 4.4.9.

    Brainstorm Force Starter Templates
  • High 7.1
    CVE-2025-24555

    WordPress Subscription DNA plugin <= 2.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in subscriptiondna Subscription DNA subscriptiondna allows Stored XSS.This issue affects Subscription DNA: from n/a through <= 2.1.

    subscriptiondna Subscription DNA
  • Medium 6.3
    CVE-2025-0701

    JoeyBling bootplus list sql injection

    A vulnerability classified as critical has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This affects an unknown part of the file /admin/sys/user/list. The manipulation of the argument sort leads to sql injection. It is poss…

    JoeyBling bootplus
  • Medium 6.3
    CVE-2025-0700

    JoeyBling bootplus list sql injection

    A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/sys/log/list. The manipulation of the argument logId leads t…

    JoeyBling bootplus