Skip to content
OpenAdvisories

Archive

11 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /11 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

333 results · Feed

  • Medium 5.9
    CVE-2025-28906 Scanner template

    WordPress Skitter Slideshow plugin <= 2.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thiago S.F. Skitter Slideshow wp-skitter-slideshow allows Stored XSS.This issue affects Skitter Slideshow: from n/a through <= 2.5.2.

    Thiago S.F. Skitter Slideshow
  • Medium 4.3
    CVE-2025-28902

    WordPress Contact Form 7 Select Box Editor Button plugin <= 0.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Benjamin Pick Contact Form 7 Select Box Editor Button contact-form-7-select-box-editor-button allows Cross Site Request Forgery.This issue affects Contact Form 7 Select Box Editor Button: from n/a through <= …

    Benjamin Pick Contact Form 7 Select Box Editor Button
  • High 7.1
    CVE-2025-28905

    WordPress Featured Posts Grid plugin <= 1.7 - CSRF to Stored XSS vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaser324 Featured Posts Grid featured-posts-grid allows Stored XSS.This issue affects Featured Posts Grid: from n/a through <= 1.7.

    Chaser324 Featured Posts Grid
  • High 7.1
    CVE-2025-28901

    WordPress Members page only for logged in users plugin <= 1.4.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This issue affects Members page only for logged in users: from n/a through <= 1.4.2.

    Naren Members page only for logged in users
  • High 7.1
    CVE-2025-28900

    WordPress TabGarb Pro plugin <= 2.6 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in webgarb TabGarb Pro tabgarb allows Stored XSS.This issue affects TabGarb Pro: from n/a through <= 2.6.

    webgarb TabGarb Pro
  • Medium 4.7
    CVE-2025-28896

    WordPress AS English Admin plugin <= 1.0.0 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through <= 1.0.0.

    Akshar Soft Solutions AS English Admin
  • High 7.1
    CVE-2025-28897

    WordPress Domain Theme plugin <= 1.3 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Steveorevo Domain Theme domain-theme allows Stored XSS.This issue affects Domain Theme: from n/a through <= 1.3.

    Steveorevo Domain Theme
  • High 7.1
    CVE-2025-28895

    WordPress Custom top bar plugin <= 2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Suman Biswas Custom top bar custom-top-bar allows Stored XSS.This issue affects Custom top bar: from n/a through <= 2.1.

    Suman Biswas Custom top bar
  • High 7.1
    CVE-2025-28892

    WordPress FTP Sync plugin <= 1.1.6 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in a2rocklobster FTP Sync ftp-sync allows Stored XSS.This issue affects FTP Sync: from n/a through <= 1.1.6.

    a2rocklobster FTP Sync
  • High 7.1
    CVE-2025-28894

    WordPress List of Posts from each Category plugin for WordPress plugin <= 2.0 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in frucomerci List of Posts from each Category plugin for WordPress list-posts-by-category allows Stored XSS.This issue affects List of Posts from each Category plugin for WordPress: from n/a through <= 2.0.

    frucomerci List of Posts from each Category plugin for WordPress Web / CMS
  • High 7.1
    CVE-2025-28891

    WordPress price-calc plugin <= 0.6.3 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in jazzigor price-calc price-calc allows Stored XSS.This issue affects price-calc: from n/a through <= 0.6.3.

    jazzigor price-calc
  • Medium 4.3
    CVE-2025-28887

    WordPress Plugins Last Updated Column plugin <= 0.1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fastmover Plugins Last Updated Column plugins-last-updated-column allows Cross Site Request Forgery.This issue affects Plugins Last Updated Column: from n/a through <= 0.1.3.

    Fastmover Plugins Last Updated Column
  • Medium 4.3
    CVE-2025-28886

    WordPress REST API TO MiniProgram plugin <= 5.1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in xjb REST API TO MiniProgram rest-api-to-miniprogram allows Cross Site Request Forgery.This issue affects REST API TO MiniProgram: from n/a through <= 5.1.2.

    xjb REST API TO MiniProgram
  • Medium 4.3
    CVE-2025-28884

    WordPress WP Bulk Post Duplicator plugin <= 1.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rajesh Kumar WP Bulk Post Duplicator wp-bulk-post-duplicator allows Cross Site Request Forgery.This issue affects WP Bulk Post Duplicator: from n/a through <= 1.2.

    Rajesh Kumar WP Bulk Post Duplicator
  • High 7.1
    CVE-2025-28883

    WordPress WP Compare Tables plugin <= 1.0.5 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Martin WP Compare Tables wp-compare-tables allows Stored XSS.This issue affects WP Compare Tables: from n/a through <= 1.0.5.

    Martin WP Compare Tables
  • Medium 4.3
    CVE-2025-28881

    WordPress Mobile Themes plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in mg12 Mobile Themes wp-mobile-themes allows Cross Site Request Forgery.This issue affects Mobile Themes: from n/a through <= 1.1.1.

    mg12 Mobile Themes
  • Medium 6.5
    CVE-2025-28879

    WordPress Bee Layer Slider plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aumsrini Bee Layer Slider bee-layer-slider allows Stored XSS.This issue affects Bee Layer Slider: from n/a through <= 1.1.

    aumsrini Bee Layer Slider
  • Medium 5.9
    CVE-2025-28878

    WordPress Awesome Surveys plugin <= 2.0.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Will Brubaker Awesome Surveys awesome-surveys allows Stored XSS.This issue affects Awesome Surveys: from n/a through <= 2.0.10.

    Will Brubaker Awesome Surveys
  • Medium 4.3
    CVE-2025-28876

    WordPress Skrill Official plugin <= 1.0.66 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Skrill_Team Skrill Official official-skrill-woocommerce allows Cross Site Request Forgery.This issue affects Skrill Official: from n/a through <= 1.0.66.

    Skrill_Team Skrill Official
  • Medium 5.9
    CVE-2025-28875

    WordPress BP Email Assign Templates By shanebp plugin <= 1.6 - Cross-Site Scripting vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Stored XSS.This issue affects BP Email Assign Templates: from n/a through <= 1.6.

    shanebp BP Email Assign Templates
  • Medium 6.5
    CVE-2025-28874

    WordPress BP Email Assign Templates By shanebp plugin <= 1.7 - Arbitrary Content Deletion vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in shanebp BP Email Assign Templates bp-email-assign-templates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BP Email Assign Templates: from n/a throug…

    shanebp BP Email Assign Templates
  • Medium 5.3
    CVE-2025-28872

    WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.

    jwpegram Block Spam By Math Reloaded
  • Medium 5.9
    CVE-2025-28871

    WordPress Block Spam By Math Reloaded plugin <= 2.2.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jwpegram Block Spam By Math Reloaded block-spam-by-math-reloaded allows Stored XSS.This issue affects Block Spam By Math Reloaded: from n/a through <= 2.2.4.

    jwpegram Block Spam By Math Reloaded
  • Medium 6.5
    CVE-2025-28870

    WordPress amoCRM WebForm plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in amocrm amoCRM WebForm amocrm-webform allows DOM-Based XSS.This issue affects amoCRM WebForm: from n/a through <= 1.1.

    amocrm amoCRM WebForm
  • Medium 4.3
    CVE-2025-28867

    WordPress Frontpage category filter plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in stesvis Frontpage category filter frontpage-category-filter allows Cross Site Request Forgery.This issue affects Frontpage category filter: from n/a through <= 1.0.2.

    stesvis Frontpage category filter
  • Medium 4.3
    CVE-2025-28866

    WordPress Login Logger plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from n/a through <= 1.2.1.

    smerriman Login Logger
  • Medium 4.3
    CVE-2025-28864

    WordPress Builder for Contact Form 7 by Webconstruct plugin <= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This issue affects Builder for Contact Form 7 by Webconstruct: from n/a through <= 1.2.2.

    Planet studio Builder for Contact Form 7 by Webconstruct
  • Medium 4.3
    CVE-2025-28863

    WordPress Delete Original Image plugin <= 0.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image delete-original-image allows Cross Site Request Forgery.This issue affects Delete Original Image: from n/a through <= 0.4.

    Carlos Minatti Delete Original Image
  • High 7.1
    CVE-2025-28861

    WordPress WP jQuery Persian Datepicker plugin <= 0.1.0 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian Datepicker: from n/a through <= 0.1.0.

    bhzad WP jQuery Persian Datepicker
  • Medium 4.3
    CVE-2025-28862

    WordPress Comment Date and Gravatar remover plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request Forgery.This issue affects Comment Date and Gravatar remover: from n/a through <= 1.0.

    Venugopal Comment Date and Gravatar remover
  • High 7.1
    CVE-2025-28860

    WordPress Google News Editors Picks Feed Generator plugin <= 2.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS.This issue affects Google News Editors Picks Feed Generator: from n/a through <= 2.1.

    PPDPurveyor Google News Editors Picks Feed Generator
  • Medium 4.3
    CVE-2025-28859

    WordPress Maintenance Notice plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maintenance Notice: from n/a through <= 1.0.6.

    CodeVibrant Maintenance Notice
  • Medium 4.3
    CVE-2025-28856

    WordPress W3Counter Free Real-Time Web Stats plugin <= 4.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.This issue affects W3Counter Free Real-Time Web Stats: from n/a through <= 4.1.

    dangrossman W3Counter Free Real-Time Web Stats
  • High 7.1
    CVE-2025-28857

    WordPress Rankchecker.io Integration plugin <= 1.0.9 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankchecker.io Integration: from n/a through <= 1.0.9.

    rankchecker Rankchecker.io Integration
  • Low 3.3
    CVE-2025-0900

    PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

    PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit …

    PDF-XChange PDF-XChange Editor
  • High 7.8
    CVE-2025-2023

    Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability

    Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vul…

    Ashlar-Vellum Cobalt
  • High 7.8
    CVE-2025-2022

    Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability

    Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vulne…

    Ashlar-Vellum Cobalt
  • High 7.8
    CVE-2025-2021

    Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability

    Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this vul…

    Ashlar-Vellum Cobalt
  • High 7.8
    CVE-2025-2020

    Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

    Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this…

    Ashlar-Vellum Cobalt
  • High 7.8
    CVE-2025-2019

    Ashlar-Vellum Cobalt VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability

    Ashlar-Vellum Cobalt VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to explo…

    Ashlar-Vellum Cobalt