Skip to content
OpenAdvisories

Archive

15 March 2025

Vulnerabilities first published on this day (UTC), newest first.

← February 2025 2025 / March /15 April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

21 results · Clear filters · Feed

  • High 8.5
    CVE-2025-27281

    WordPress All In Menu Plugin <= 1.1.5 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cookforweb All In Menu all-in-menu allows Blind SQL Injection.This issue affects All In Menu: from n/a through <= 1.1.5.

    cookforweb All In Menu
  • High 8.5
    CVE-2025-26976

    WordPress PrivateContent plugin <= 8.11.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aldo Latino PrivateContent private-content.This issue affects PrivateContent: from n/a through <= 8.11.4.

    Aldo Latino PrivateContent
  • High 8.5
    CVE-2025-26978

    WordPress FS Poster plugin <= 6.5.8 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in fs-code FS Poster fs-poster.This issue affects FS Poster: from n/a through <= 6.5.8.

    fs-code FS Poster
  • High 8.3
    CVE-2025-26969

    WordPress PrivateContent plugin <= 8.11.5 - Subscriber+ Site Wide Broken Access Control vulnerability

    Missing Authorization vulnerability in Aldo Latino PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.

    Aldo Latino PrivateContent
  • High 8.6
    CVE-2025-26961

    WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in FRESHFACE Fresh Framework fresh-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Fresh Framework: from n/a through <= 1.70.0.

    FRESHFACE Fresh Framework
  • High 7.1
    CVE-2025-26972

    WordPress PrivateContent plugin <= 8.11.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound PrivateContent. This issue affects PrivateContent: from n/a through 8.11.5.

    NotFound PrivateContent
  • High 8.8
    CVE-2025-26921

    WordPress Booking and Rental Manager Plugin <= 2.2.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Object Injection.This issue affects Booking and Rental Manager: from n/a through <= 2.2.6.

    MagePeople Team Booking and Rental Manager
  • High 7.1
    CVE-2025-26555

    WordPress Debug-Bar-Extender Plugin <= 0.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through <= 0.5.

    Thorsten Ott Debug-Bar-Extender
  • High 7.1
    CVE-2025-26556

    WordPress WP AntiDDOS Plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zzmaster WP AntiDDOS wpantiddos allows Reflected XSS.This issue affects WP AntiDDOS: from n/a through <= 2.0.

    zzmaster WP AntiDDOS
  • High 7.6
    CVE-2025-26886

    WordPress PublishPress Authors plugin <= 4.7.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through <= 4.7.3.

    publishpress PublishPress Authors
  • High 7.1
    CVE-2025-23744

    WordPress Random Posts, Mp3 Player + ShareButton plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dvs11 Random Posts, Mp3 Player + ShareButton random-posts-mp3-player-sharebutton allows Reflected XSS.This issue affects Random Posts, Mp3 Player + ShareButt…

    dvs11 Random Posts, Mp3 Player + ShareButton
  • High 7.1
    CVE-2025-26553

    WordPress Pre Order Addon for WooCommerce plugin<= 1.0.7 - Reflected Cross-Site Scripting

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin wc-pre-order allows Reflected XSS.This issue affects Pre Order Addon for WooComm…

    Spring Devs Pre Order Addon for WooCommerce – Advance Order/Backorder Plugin Web / CMS
  • High 7.1
    CVE-2025-26548

    WordPress Random Image Selector plugin <= 1.5.6 - Reflected Cross-Site Scripting vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kdmurray Random Image Selector random-image-selector allows Reflected XSS.This issue affects Random Image Selector: from n/a through <= 2.4.

    kdmurray Random Image Selector
  • High 7.1
    CVE-2025-26554

    WordPress WP Discord Post Plugin <= 2.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicola Mustone WP Discord Post wp-discord-post allows Reflected XSS.This issue affects WP Discord Post: from n/a through <= 2.1.0.

    Nicola Mustone WP Discord Post
  • High 7.3
    CVE-2025-2322

    274056675 springboot-openai-chatgpt OpenController.java hard-coded credentials

    A vulnerability was found in 274056675 springboot-openai-chatgpt e84f6f5. It has been classified as critical. This affects an unknown part of the file /chatgpt-boot/src/main/java/org/springblade/modules/mjkj/controller/OpenController.java. The manipulation le…

    274056675 springboot-openai-chatgpt
  • High 7.2
    CVE-2025-2325

    WP Test Email <= 1.1.8 - Unauthenticated Stored Cross-Site Scripting

    The WP Test Email plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Logs in all versions up to, and including, 1.1.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to …

    boopathi0001 WP Test Email Web / CMS
  • High 7.2
    CVE-2024-13497

    WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto <= 8.0.9 - Unauthenticated Stored Cross-Site Scripting

    The WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via attachment uploads in all versions up to, and including, 8.0.9 due to insufficient input sanitization and…

    Tripetto WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto Web / CMS
  • High 8.8
    CVE-2025-1667

    School Management System – WPSchoolPress <= 2.2.16 - Missing Authorization to Privilege Escalation via Account Takeover

    The School Management System – WPSchoolPress plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wpsp_UpdateTeacher() function in all versions up to, and including, 2.2.16. This makes it possible for authenticat…

    jdsofttech School Management System – WPSchoolPress Web / CMS
  • High 8.8
    CVE-2025-1653

    Directory Listings WordPress plugin – uListing <= 2.2.0 - Authenticated (Subscriber+) Privilege Escalation

    The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.2.0. This is due to the stm_listing_profile_edit AJAX action not having enough restriction on the user meta t…

    stylemix Directory Listings WordPress plugin – uListing Web / CMS
  • High 8.8
    CVE-2025-1657

    Directory Listings WordPress plugin – uListing <= 2.2.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Update and PHP Object Injection

    The Directory Listings WordPress plugin – uListing plugin for WordPress is vulnerable to unauthorized modification of data and PHP Object Injection due to a missing capability check on the stm_listing_ajax AJAX action in all versions up to, and including, 2.2…

    stylemix Directory Listings WordPress plugin – uListing Web / CMS
  • High 8.6
    CVE-2025-30066 Exploited Public exploit EPSS 72%

    tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which cont…

    tj-actions changed-files tj-actions/changed-files GitHub Actions
    KEV Mar 18, 2025