Skip to content
OpenAdvisories

Archive

11 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /11 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

132 results · Clear filters · Feed

  • Medium 4.7
    CVE-2025-2215

    Doufox s=doudou path traversal

    A vulnerability classified as critical was found in Doufox up to 0.2.0. Affected by this vulnerability is an unknown functionality of the file /?s=doudou&c=file&a=list. The manipulation of the argument dir leads to path traversal. The attack can be launched r…

  • Medium 4.3
    CVE-2025-28868

    WordPress ZipList Recipe plugin <= 3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ZipList ZipList Recipe ziplist-recipe-plugin allows Cross Site Request Forgery.This issue affects ZipList Recipe: from n/a through <= 3.1.

    ZipList ZipList Recipe
  • Medium 5.9
    CVE-2025-28943

    WordPress DP ALTerminator - Missing ALT manager Plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-alterminator-missing-alt-manager allows Stored XSS.This issue affects DP ALTerminator - Missing ALT manager…

    mylo2h2s DP ALTerminator - Missing ALT manager
  • Medium 4.3
    CVE-2025-28941

    WordPress SPAM-BYBYE Plugin <= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ohtan Spam Byebye spam-byebye allows Cross Site Request Forgery.This issue affects Spam Byebye: from n/a through <= 2.2.4.

    ohtan Spam Byebye
  • Medium 4.3
    CVE-2025-28940

    WordPress Back To Top Plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in arkapravamajumder Back To Top backtotop allows Cross Site Request Forgery.This issue affects Back To Top: from n/a through <= 2.0.

    arkapravamajumder Back To Top
  • Medium 4.3
    CVE-2025-28938

    WordPress WP Performance Pack plugin <= 2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Performance Pack: from n/a through <= 2.5.3.

    Bjoern WP Performance Pack
  • Medium 5.9
    CVE-2025-28936

    WordPress Lunar plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sakurapixel Lunar lunar-sell-photos-online allows Stored XSS.This issue affects Lunar: from n/a through <= 1.3.0.

    sakurapixel Lunar
  • Medium 5.9
    CVE-2025-28937

    WordPress Lava Ajax Search plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through <= 1.1.9.

    lavacode Lava Ajax Search
  • Medium 6.5
    CVE-2025-28930

    WordPress List Mixcloud plugin <= 1.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodolphe MOULIN List Mixcloud list-mixcloud allows Stored XSS.This issue affects List Mixcloud: from n/a through <= 1.4.

    Rodolphe MOULIN List Mixcloud
  • Medium 6.5
    CVE-2025-28929

    WordPress Tabbed Login Widget plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vivek Marakana Tabbed Login Widget tabbed-login allows Stored XSS.This issue affects Tabbed Login Widget: from n/a through <= 1.1.2.

    Vivek Marakana Tabbed Login Widget
  • Medium 4.3
    CVE-2025-28927

    WordPress Display Template Name plugin <= 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in A. Chappard Display Template Name display-template-name allows Cross Site Request Forgery.This issue affects Display Template Name: from n/a through <= 1.7.1.

    A. Chappard Display Template Name
  • Medium 5.9
    CVE-2025-28926

    WordPress Post Read Time plugin <= 1.2.6 - Stored Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in popeating Post Read Time post-read-time allows Stored XSS.This issue affects Post Read Time: from n/a through <= 1.2.6.

    popeating Post Read Time
  • Medium 5.3
    CVE-2025-28920

    WordPress Responsive Google Map plugin <= 3.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Google Map: from n/a through <= 3.1.5.

    Jogesh Responsive Google Map
  • Medium 6.5
    CVE-2025-28919

    WordPress Easy Image Display plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shellbot Easy Image Display easy-image-display allows Stored XSS.This issue affects Easy Image Display: from n/a through <= 1.2.5.

    shellbot Easy Image Display
  • Medium 6.5
    CVE-2025-28918

    WordPress Featured Image Thumbnail Grid plugin <= 6.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones Featured Image Thumbnail Grid thumbnail-grid allows Stored XSS.This issue affects Featured Image Thumbnail Grid: from n/a through <= 6.8.

    A. Jones Featured Image Thumbnail Grid
  • Medium 5.9
    CVE-2025-28914

    WordPress wordpress login form to anywhere plugin <= 0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay Sharma wordpress login form to anywhere wp-show-login-form allows Stored XSS.This issue affects wordpress login form to anywhere: from n/a through <= 0.…

    Ajay Sharma wordpress login form to anywhere Web / CMS
  • Medium 4.3
    CVE-2025-28913

    WordPress WP Add Active Class To Menu Item plugin <=1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Aftab Ali Muni WP Add Active Class To Menu Item wp-add-active-class-to-menu-item allows Cross Site Request Forgery.This issue affects WP Add Active Class To Menu Item: from n/a through <= 1.0.

    Aftab Ali Muni WP Add Active Class To Menu Item
  • Medium 4.3
    CVE-2025-28912

    WordPress Custom Dashboard Page plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Muntasir Rahman Custom Dashboard Page custom-dashboard-page allows Cross Site Request Forgery.This issue affects Custom Dashboard Page: from n/a through <= 1.0.

    Muntasir Rahman Custom Dashboard Page
  • Medium 4.3
    CVE-2025-28910

    WordPress WP Hide Admin Bar plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Ravinder Khurana WP Hide Admin Bar wp-hide-admin-bar allows Cross Site Request Forgery.This issue affects WP Hide Admin Bar: from n/a through <= 2.0.

    Ravinder Khurana WP Hide Admin Bar
  • Medium 4.3
    CVE-2025-28909

    WordPress WP No-Bot Question plugin <= 0.1.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in edwardw WP No-Bot Question wp-no-bot-question allows Cross Site Request Forgery.This issue affects WP No-Bot Question: from n/a through <= 0.1.7.

    edwardw WP No-Bot Question
  • Medium 5.9
    CVE-2025-28908

    WordPress pipDisqus plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pipdig pipDisqus pipdisqus allows Stored XSS.This issue affects pipDisqus: from n/a through <= 1.6.

    pipdig pipDisqus
  • Medium 5.9
    CVE-2025-28907

    WordPress WP Last Modified plugin <= 0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rahul Arora WP Last Modified wp-last-modified allows Stored XSS.This issue affects WP Last Modified: from n/a through <= 0.1.

    Rahul Arora WP Last Modified
  • Medium 5.9
    CVE-2025-28906 Scanner template

    WordPress Skitter Slideshow plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow wp-skitter-slideshow allows Stored XSS.This issue affects Skitter Slideshow: from n/a through <= 2.5.2.

    Thiago S.F. Skitter Slideshow
  • Medium 4.3
    CVE-2025-28902

    WordPress Contact Form 7 Select Box Editor Button plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross Site Request Forgery.This issue affects Contact Form 7 Select Box Editor Button: from n/a through <= …

    Benjamin Pick Contact Form 7 Select Box Editor Button
  • Medium 4.7
    CVE-2025-28896

    WordPress AS English Admin plugin <= 1.0.0 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through <= 1.0.0.

    Akshar Soft Solutions AS English Admin
  • Medium 4.3
    CVE-2025-28887

    WordPress Plugins Last Updated Column plugin <= 0.1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This issue affects Plugins Last Updated Column: from n/a through <= 0.1.3.

    Fastmover Plugins Last Updated Column
  • Medium 4.3
    CVE-2025-28886

    WordPress REST API TO MiniProgram plugin <= 5.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects REST API TO MiniProgram: from n/a through <= 5.1.2.

    xjb REST API TO MiniProgram
  • Medium 4.3
    CVE-2025-28884

    WordPress WP Bulk Post Duplicator plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Kumar WP Bulk Post Duplicator wp-bulk-post-duplicator allows Cross Site Request Forgery.This issue affects WP Bulk Post Duplicator: from n/a through <= 1.2.

    Rajesh Kumar WP Bulk Post Duplicator
  • Medium 4.3
    CVE-2025-28881

    WordPress Mobile Themes plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in mg12 Mobile Themes wp-mobile-themes allows Cross Site Request Forgery.This issue affects Mobile Themes: from n/a through <= 1.1.1.

    mg12 Mobile Themes
  • Medium 6.5
    CVE-2025-28879

    WordPress Bee Layer Slider plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider bee-layer-slider allows Stored XSS.This issue affects Bee Layer Slider: from n/a through <= 1.1.

    aumsrini Bee Layer Slider
  • Medium 5.9
    CVE-2025-28878

    WordPress Awesome Surveys plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will Brubaker Awesome Surveys awesome-surveys allows Stored XSS.This issue affects Awesome Surveys: from n/a through <= 2.0.10.

    Will Brubaker Awesome Surveys
  • Medium 4.3
    CVE-2025-28876

    WordPress Skrill Official plugin <= 1.0.66 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Skrill_Team Skrill Official official-skrill-woocommerce allows Cross Site Request Forgery.This issue affects Skrill Official: from n/a through <= 1.0.66.

    Skrill_Team Skrill Official
  • Medium 5.9
    CVE-2025-28875

    WordPress BP Email Assign Templates By shanebp plugin <= 1.6 - Cross-Site Scripting vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.

    shanebp BP Email Assign Templates
  • Medium 6.5
    CVE-2025-28874

    WordPress BP Email Assign Templates By shanebp plugin <= 1.7 - Arbitrary Content Deletion vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a throug…

    shanebp BP Email Assign Templates
  • Medium 5.3
    CVE-2025-28872

    WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.

    jwpegram Block Spam By Math Reloaded
  • Medium 5.9
    CVE-2025-28871

    WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.

    jwpegram Block Spam By Math Reloaded
  • Medium 6.5
    CVE-2025-28870

    WordPress amoCRM WebForm plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.

    amocrm amoCRM WebForm
  • Medium 4.3
    CVE-2025-28867

    WordPress Frontpage category filter plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue affects Frontpage category filter: from n/a through <= 1.0.2.

    stesvis Frontpage category filter
  • Medium 4.3
    CVE-2025-28866

    WordPress Login Logger plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from n/a through <= 1.2.1.

    smerriman Login Logger
  • Medium 4.3
    CVE-2025-28864

    WordPress Builder for Contact Form 7 by Webconstruct plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through <= 1.2.2.

    Planet studio Builder for Contact Form 7 by Webconstruct