Skip to content
OpenAdvisories

Archive

8 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /8 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

8 results · Clear filters · Feed

  • High 8.8
    CVE-2024-11640

    VikRentCar Car Rental Management System <= 1.4.2 - Cross-Site Request Forgery to Authenticated (Subscriber+) Arbitrary File Upload

    The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4.2. This is due to missing or incorrect nonce validation on the 'save' function. This makes it possible for u…

    e4jvikwp VikRentCar Car Rental Management System Web / CMS
  • High 7.5
    CVE-2025-1323 Public exploit Scanner template

    WP-Recall – Registration, Profile, Commerce & More <= 16.26.10 - Unauthenticated SQL Injection

    The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in all versions up to, and including, 16.26.10 due to insufficient escaping on the user supplied parameter and lack of suff…

    wppost WP-Recall – Registration, Profile, Commerce & More Web / CMS
  • High 8.1
    CVE-2024-13359

    Product Input Fields for WooCommerce <= 1.12.0 - Unauthenticated Limited File Upload

    The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the add_product_input_fields_to_order_item_meta() function in all versions up to, and including, 1.12.0. This may…

    Tyche Softwares Product Input Fields for WooCommerce Web / CMS
  • High 8.8
    CVE-2024-13882

    Aiomatic - AI Content Writer, Editor, ChatBot & AI Toolkit <= 2.3.8 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Upload

    The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aiomatic_generate_featured_image' function in all version…

    CodeRevolution Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit Web / CMS
  • High 8.1
    CVE-2024-11087

    miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon <= 200.3.9 - Authentication Bypass

    The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being retur…

    cyberlord92 miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) Web / CMS
  • High 7.2
    CVE-2024-13908

    SMTP by BestWebSoft <= 1.1.9 - Authenticated (Administrator+) Arbitrary File Upload

    The SMTP by BestWebSoft plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'save_options' function in all versions up to, and including, 1.1.9. This makes it possible for authenticated attackers, with Admin…

    bestweblayout SMTP by BestWebSoft Web / CMS
  • High 7.2
    CVE-2024-13835

    Post Meta Data Manager <= 1.4.4 - Authentciated (Admin+) Multisite Privilege Escalation

    The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta…

    gandhihitesh9 Post Meta Data Manager Web / CMS
  • High 7.2
    CVE-2024-13890

    Allow PHP Execute <= 1.0 - Authenticated (Editor+) PHP Code Injection

    The Allow PHP Execute plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.0. This is due to allowing PHP code to be entered by all users for whom unfiltered HTML is allowed. This makes it possible for authenticated…

    SKSDEV Allow PHP Execute Web / CMS