Skip to content
OpenAdvisories

Archive

25 February 2025

Vulnerabilities first published on this day (UTC), newest first.

← January 2025 2025 / February /25 March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

68 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-26893

    WordPress Easy Charts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Potphode Easy Charts easy-charts allows DOM-Based XSS.This issue affects Easy Charts: from n/a through <= 1.2.3.

    Kiran Potphode Easy Charts
  • Medium 6.5
    CVE-2025-26896

    WordPress PiwigoPress plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress piwigopress allows Stored XSS.This issue affects PiwigoPress: from n/a through <= 2.33.

    vpiwigo PiwigoPress
  • Medium 6.5
    CVE-2025-26891

    WordPress Ibtana plugin <= 1.2.5.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Stored XSS.This issue affects Ibtana: from n/a through <= 1.2.5.9.

    VW THEMES Ibtana
  • Medium 6.5
    CVE-2025-26887

    WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.21.35 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a …

    Eli EZ SQL Reports Shortcode Widget and DB Backup
  • Medium 6.5
    CVE-2025-26897

    WordPress List Related Attachments plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baden List Related Attachments list-related-attachments-widget allows DOM-Based XSS.This issue affects List Related Attachments: from n/a through <= 2.1.6.

    Baden List Related Attachments
  • Medium 6.5
    CVE-2025-26884

    WordPress Greenshift plugin <= 10.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 10.8.

    wpsoul Greenshift
  • Medium 6.5
    CVE-2025-26878

    WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows DOM-Based XSS.This issue affects Autoship Cloud for WooCommerce…

    Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products Web / CMS
  • Medium 6.5
    CVE-2025-26882

    WordPress Popup Builder plugin <= 1.1.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder easy-notify-lite allows Stored XSS.This issue affects Popup Builder: from n/a through <= 1.1.33.

    GhozyLab Popup Builder
  • Medium 6.8
    CVE-2025-26876

    WordPress Search with Typesense Plugin <= 2.0.8 - Path Traversal vulnerability

    Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.

    CodeManas Search with Typesense
  • Medium 6.5
    CVE-2025-26881

    WordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.

    bPlugins Sticky Content
  • Medium 6.5
    CVE-2025-26877

    WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.30.

    Rustaurius Front End Users
  • Medium 4.3
    CVE-2025-26871

    WordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.

    WPDeveloper Essential Blocks for Gutenberg
  • Medium 6.5
    CVE-2024-54444

    WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10.

    Elementor Elementor Website Builder
  • Medium 5.4
    CVE-2025-27000

    WordPress Simple Photo Feed Plugin <= 1.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Photo Feed: from n/a through <= 1.4.0.

    George Pattichis Simple Photo Feed
  • Medium 5.3
    CVE-2025-1262

    Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass

    The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.

    webfactory Advanced Google reCAPTCHA Web / CMS
  • Medium 6.3
    CVE-2025-1676

    hzmanyun Education and Training System pdf2swf os command injection

    A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can …

    hzmanyun Education and Training System
  • Medium 5.3
    CVE-2024-13693

    Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php

    The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia setting…

    Kriesi Enfold - Responsive Multi-Purpose Theme Web / CMS
  • Medium 6.4
    CVE-2024-13695

    Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id

    The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web …

    Kriesi Enfold - Responsive Multi-Purpose Theme Web / CMS
  • Medium 4.3
    CVE-2024-13494

    WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details

    The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfu_file_details' function. This makes it possible for unauth…

    Nickboss Iptanus File Upload Web / CMS
  • Medium 5.3
    CVE-2025-1063

    Classified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings Exposure

    The Classified Listing – Classified ads & Business Directory Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.0.4 via the rtcl_taxonomy_settings_export function. This makes it possible for una…

    techlabpro1 Classified Listing – AI-Powered Classified ads & Business Directory Plugin Web / CMS
  • Medium 6.3
    CVE-2025-1645

    Benner Connecta EditarLogado resource injection

    A vulnerability classified as critical was found in Benner Connecta 1.0.5330. Affected by this vulnerability is an unknown functionality of the file /Usuarios/Usuario/EditarLogado/. The manipulation of the argument Handle leads to improper control of resource…

    Benner Connecta
  • Medium 4.3
    CVE-2025-1644

    Benner ModernaNet SG_Gravar cross-site request forgery

    A vulnerability classified as problematic has been found in Benner ModernaNet up to 1.2.0. Affected is an unknown function of the file /DadosPessoais/SG_Gravar. The manipulation of the argument idItAg leads to cross-site request forgery. It is possible to lau…

    Benner ModernaNet
  • Medium 4.3
    CVE-2025-1643

    Benner ModernaNet SG_AlterarSenha cross-site request forgery

    A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been rated as problematic. This issue affects some unknown processing of the file /DadosPessoais/SG_AlterarSenha. The manipulation leads to cross-site request forgery. The attack may be initia…

    Benner ModernaNet
  • Medium 4.3
    CVE-2025-1642

    Benner ModernaNet GetImageMedico resource injection

    A vulnerability was found in Benner ModernaNet up to 1.1.0. It has been declared as critical. This vulnerability affects unknown code of the file /AGE0000700/GetImageMedico?fooId=1. The manipulation of the argument fooId leads to improper control of resource …

    Benner ModernaNet
  • Medium 5.7
    CVE-2024-34034

    An issue was discovered in FlexRIC 2.0.0. It crashes during a Subscription Request denial-of-service (DoS) attack, trig…

  • Medium 5.7
    CVE-2024-34035

    An issue was discovered in O-RAN Near Realtime RIC H-Release. To trigger the crashing of the e2mgr, an adversary must f…

  • Medium 4.3
    CVE-2024-34036

    An issue was discovered in O-RAN Near Realtime RIC I-Release. To exploit this vulnerability, an attacker can disrupt th…

  • Medium 6.5
    CVE-2025-25514

    Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.