Skip to content
OpenAdvisories

Archive

February 2025

Vulnerabilities first published in this month (UTC), newest first.

← January 2025 2025 / February March 2025 →
  1. 139
  2. 24
  3. 3187
  4. 4151
  5. 5119
  6. 699
  7. 7120
  8. 87
  9. 94
  10. 1081
  11. 11283
  12. 12265
  13. 13132
  14. 14134
  15. 1524
  16. 1640
  17. 1748
  18. 18162
  19. 19125
  20. 20120
  21. 2192
  22. 2234
  23. 2330
  24. 24119
  25. 25144
  26. 26795
  27. 27275
  28. 2887
All Critical High Medium Low Exploited only Public exploit

1,716 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-26983

    WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: fr…

    WPZOOM Recipe Card Blocks for Gutenberg & Elementor
  • Medium 5.4
    CVE-2025-26995

    WordPress Market Exporter plugin <= 2.0.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Anton Vanyukov Market Exporter market-exporter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Market Exporter: from n/a through <= 2.0.21.

    Anton Vanyukov Market Exporter
  • Medium 5.3
    CVE-2025-26975

    WordPress Strong Testimonials plugin <= 3.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Strong Testimonials: from n/a through <= 3.2.3.

    WP Chill Strong Testimonials
  • Medium 6.5
    CVE-2025-26980

    WordPress Wired Impact Volunteer Management plugin <= 2.5 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wired Impact Wired Impact Volunteer Management wired-impact-volunteer-management allows Stored XSS.This issue affects Wired Impact Volunteer Management: from…

    Wired Impact Wired Impact Volunteer Management
  • Medium 5.3
    CVE-2025-26965

    WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through <= 1.2.16.

    ameliabooking Amelia
  • Medium 6.5
    CVE-2025-26962

    WordPress Contact Form Plugin plugin <= 1.1.25 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Easy Contact Form Lite contact-form-lite allows Stored XSS.This issue affects Easy Contact Form Lite : from n/a through <= 1.1.25.

    GhozyLab Easy Contact Form Lite
  • Medium 5.4
    CVE-2025-26963

    WordPress ClickWhale plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ClickWhale ClickWhale clickwhale allows Cross Site Request Forgery.This issue affects ClickWhale: from n/a through <= 2.4.3.

    ClickWhale ClickWhale
  • Medium 6.5
    CVE-2025-26960

    WordPress Small Package Quotes – Unishippers Edition plugin <= 2.4.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in enituretechnology Small Package Quotes – Unishippers Edition small-package-quotes-unishippers-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Small Package Quotes – Unis…

    Eniture technology Small Package Quotes – Unishippers Edition
  • Medium 6.5
    CVE-2025-26949

    WordPress Team Section Block plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Team Section Block team-section allows Stored XSS.This issue affects Team Section Block: from n/a through <= 1.0.9.

    bPlugins Team Section Block
  • Medium 6.5
    CVE-2025-26952

    WordPress Business Card Block plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Business Card Block business-card-block allows Stored XSS.This issue affects Business Card Block: from n/a through <= 1.0.5.

    bPlugins Business Card Block
  • Medium 6.5
    CVE-2025-26947

    WordPress Services Section block plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Services Section block services-section allows Stored XSS.This issue affects Services Section block: from n/a through <= 1.3.4.

    bPlugins Services Section block
  • Medium 4.3
    CVE-2025-26948

    WordPress Pie Register Premium plugin <= 3.8.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NotFound Pie Register Premium. This issue affects Pie Register Premium: from n/a through 3.8.3.2.

    NotFound Pie Register Premium
  • Medium 6.5
    CVE-2025-26938

    WordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Countdown Timer countdown-time allows Stored XSS.This issue affects Countdown Timer: from n/a through <= 1.2.6.

    bPlugins Countdown Timer
  • Medium 6.5
    CVE-2025-26945

    WordPress Info Cards plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Info Cards info-cards allows Stored XSS.This issue affects Info Cards: from n/a through <= 1.0.5.

    bPlugins Info Cards
  • Medium 6.5
    CVE-2025-26939

    WordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Counters Block counters-block allows Stored XSS.This issue affects Counters Block: from n/a through <= 1.1.2.

    bPlugins Counters Block
  • Medium 6.5
    CVE-2025-26937

    WordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Icon List Block icon-list-block allows Stored XSS.This issue affects Icon List Block: from n/a through <= 1.1.3.

    bPlugins Icon List Block
  • Medium 4.3
    CVE-2025-26926

    WordPress Booknetic plugin < 5.10.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Booknetic Booknetic booknetic allows Cross Site Request Forgery.This issue affects Booknetic: from n/a before 5.10.4.

    Booknetic Booknetic
  • Medium 4.3
    CVE-2025-26928

    WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Xfinitysoft Order Limit for WooCommerce wc-order-limit-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Limit for WooCommerce: from n/a through <= 3.0.2.

    Xfinity Soft Order Limit for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-26904

    WordPress WP Responsive Auto Fit Text plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gal_op WP Responsive Auto Fit Text wp-responsive-slab-text allows DOM-Based XSS.This issue affects WP Responsive Auto Fit Text: from n/a through <= 0.2.

    gal_op WP Responsive Auto Fit Text
  • Medium 6.5
    CVE-2025-26913

    WordPress AR for WordPress plugin <= 7.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webandprint AR For WordPress ar-for-wordpress allows DOM-Based XSS.This issue affects AR For WordPress: from n/a through <= 7.7.

    webandprint AR for WordPress Web / CMS
  • Medium 4.3
    CVE-2025-26911

    WordPress System Dashboard plugin <= 2.8.18 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bowo System Dashboard system-dashboard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects System Dashboard: from n/a through <=…

    Bowo System Dashboard
  • Medium 6.5
    CVE-2025-26912

    WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.1.6.

    HashThemes Easy Elementor Addons
  • Medium 6.5
    CVE-2025-26893

    WordPress Easy Charts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kiran Potphode Easy Charts easy-charts allows DOM-Based XSS.This issue affects Easy Charts: from n/a through <= 1.2.3.

    Kiran Potphode Easy Charts
  • Medium 6.5
    CVE-2025-26896

    WordPress PiwigoPress plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vpiwigo PiwigoPress piwigopress allows Stored XSS.This issue affects PiwigoPress: from n/a through <= 2.33.

    vpiwigo PiwigoPress
  • Medium 6.5
    CVE-2025-26891

    WordPress Ibtana plugin <= 1.2.5.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana ibtana-visual-editor allows Stored XSS.This issue affects Ibtana: from n/a through <= 1.2.5.9.

    VW THEMES Ibtana
  • Medium 6.5
    CVE-2025-26887

    WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.21.35 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eli EZ SQL Reports Shortcode Widget and DB Backup elisqlreports allows Stored XSS.This issue affects EZ SQL Reports Shortcode Widget and DB Backup: from n/a …

    Eli EZ SQL Reports Shortcode Widget and DB Backup
  • Medium 6.5
    CVE-2025-26897

    WordPress List Related Attachments plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Baden List Related Attachments list-related-attachments-widget allows DOM-Based XSS.This issue affects List Related Attachments: from n/a through <= 2.1.6.

    Baden List Related Attachments
  • Medium 6.5
    CVE-2025-26884

    WordPress Greenshift plugin <= 10.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 10.8.

    wpsoul Greenshift
  • Medium 6.5
    CVE-2025-26878

    WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in patternsinthecloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows DOM-Based XSS.This issue affects Autoship Cloud for WooCommerce…

    Patterns in the cloud Autoship Cloud for WooCommerce Subscription Products Web / CMS
  • Medium 6.5
    CVE-2025-26882

    WordPress Popup Builder plugin <= 1.1.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Popup Builder easy-notify-lite allows Stored XSS.This issue affects Popup Builder: from n/a through <= 1.1.33.

    GhozyLab Popup Builder
  • Medium 6.8
    CVE-2025-26876

    WordPress Search with Typesense Plugin <= 2.0.8 - Path Traversal vulnerability

    Path Traversal: '.../...//' vulnerability in CodeManas Search with Typesense search-with-typesense allows Path Traversal.This issue affects Search with Typesense: from n/a through <= 2.0.8.

    CodeManas Search with Typesense
  • Medium 6.5
    CVE-2025-26881

    WordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Sticky Content sticky-menu-block allows Stored XSS.This issue affects Sticky Content: from n/a through <= 1.0.1.

    bPlugins Sticky Content
  • Medium 6.5
    CVE-2025-26877

    WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows Stored XSS.This issue affects Front End Users: from n/a through <= 3.2.30.

    Rustaurius Front End Users
  • Medium 4.3
    CVE-2025-26871

    WordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg essential-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through <= 4.8.3.

    WPDeveloper Essential Blocks for Gutenberg
  • Medium 6.5
    CVE-2024-54444

    WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Elementor Elementor Website Builder elementor allows Stored XSS.This issue affects Elementor Website Builder: from n/a through <= 3.25.10.

    Elementor Elementor Website Builder
  • Medium 5.4
    CVE-2025-27000

    WordPress Simple Photo Feed Plugin <= 1.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in George Pattichis Simple Photo Feed simple-photo-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Photo Feed: from n/a through <= 1.4.0.

    George Pattichis Simple Photo Feed
  • Medium 5.3
    CVE-2025-1262

    Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypass

    The Advanced Google reCaptcha plugin for WordPress is vulnerable to CAPTCHA Bypass in versions up to, and including, 1.27 . This makes it possible for unauthenticated attackers to bypass the Built-in Math Captcha Verification.

    webfactory Advanced Google reCAPTCHA Web / CMS
  • Medium 6.3
    CVE-2025-1676

    hzmanyun Education and Training System pdf2swf os command injection

    A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can …

    hzmanyun Education and Training System
  • Medium 5.3
    CVE-2024-13693

    Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.php

    The Enfold theme for WordPress is vulnerable to unauthorized access of data due to a missing capability check in avia-export-class.php in all versions up to, and including, 6.0.9. This makes it possible for unauthenticated attackers to export all avia setting…

    Kriesi Enfold - Responsive Multi-Purpose Theme Web / CMS
  • Medium 6.4
    CVE-2024-13695

    Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id

    The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachment_id' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web …

    Kriesi Enfold - Responsive Multi-Purpose Theme Web / CMS