Skip to content
OpenAdvisories

Archive

March 2025

Vulnerabilities first published in this month (UTC), newest first.

← February 2025 2025 / March April 2025 →
  1. 148
  2. 230
  3. 3349
  4. 4148
  5. 5141
  6. 6143
  7. 7113
  8. 840
  9. 924
  10. 1087
  11. 11333
  12. 12105
  13. 1391
  14. 1486
  15. 1544
  16. 1633
  17. 17134
  18. 1871
  19. 1986
  20. 20373
  21. 2166
  22. 2238
  23. 2341
  24. 24158
  25. 25137
  26. 26171
  27. 27377
  28. 28173
  29. 2910
  30. 3016
  31. 31373
All Critical High Medium Low Exploited only Public exploit

1,816 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-30873

    WordPress Greenshift plugin <= 11.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Stored XSS.This issue affects Greenshift: from n/a through <= 11.0.2.

    wpsoul Greenshift
  • Medium 6.5
    CVE-2025-30867

    WordPress SearchIQ plugin <= 4.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ searchiq allows Stored XSS.This issue affects SearchIQ: from n/a through <= 4.7.

    SearchIQ SearchIQ
  • Medium 4.3
    CVE-2025-30865

    WordPress 3DPrint Lite plugin <= 2.1.3.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in fuzzoid 3DPrint Lite 3dprint-lite allows Cross Site Request Forgery.This issue affects 3DPrint Lite: from n/a through <= 2.1.3.5.

    fuzzoid 3DPrint Lite
  • Medium 5.3
    CVE-2025-30866

    WordPress Terms & Conditions Per Product plugin <= 1.2.15 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Giannis Kipouros Terms & Conditions Per Product terms-and-conditions-per-product allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Terms & Conditions Per Product: from n/a through…

    Giannis Kipouros Terms & Conditions Per Product
  • Medium 4.3
    CVE-2025-30864

    WordPress Exchange Rates plugin <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in falselight Exchange Rates exchange-rates allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exchange Rates: from n/a through <= 1.2.2.

    falselight Exchange Rates
  • Medium 4.3
    CVE-2025-30863

    WordPress Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms integration-for-contact-form-7-and-google-sheets allows Cross Site Request Forgery.This issue affects Integration fo…

    CRM Perks Integration for Google Sheets and Contact Form 7, WPForms, Elementor, Ninja Forms
  • Medium 4.3
    CVE-2025-30862

    WordPress reCAPTCHA for all plugin <= 2.22 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sminozzi reCAPTCHA for all recaptcha-for-all allows Cross Site Request Forgery.This issue affects reCAPTCHA for all: from n/a through <= 2.22.

    sminozzi reCAPTCHA for all
  • Medium 4.9
    CVE-2025-30861

    WordPress Five Star Restaurant Reservations plugin <= 2.6.29 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.6.2…

    Rustaurius Five Star Restaurant Reservations
  • Medium 4.7
    CVE-2025-30859

    WordPress AliNext plugin <= 3.5.1 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in guru-aliexpress AliNext ali2woo-lite allows Phishing.This issue affects AliNext: from n/a through <= 3.5.1.

    guru-aliexpress AliNext
  • Medium 6.5
    CVE-2025-30860

    WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows DOM-Based XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): fr…

    Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars)
  • Medium 4.3
    CVE-2025-30856

    WordPress Custom Field For WP Job Manager plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in theme funda Custom Field For WP Job Manager custom-field-for-wp-job-manager allows Cross Site Request Forgery.This issue affects Custom Field For WP Job Manager: from n/a through <= 1.4.

    theme funda Custom Field For WP Job Manager
  • Medium 4.3
    CVE-2025-30854

    WordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.7.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Cross Site Request Forgery.This issue affects Serial Codes Generator and Validator with WooC…

    Vollstart Serial Codes Generator and Validator with WooCommerce Support Web / CMS
  • Medium 6.5
    CVE-2025-30850

    WordPress Dr. Flex plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sfaerber Dr. Flex dr-flex allows Stored XSS.This issue affects Dr. Flex: from n/a through <= 2.0.0.

    sfaerber Dr. Flex
  • Medium 4.3
    CVE-2025-30851

    WordPress Tickera plugin <= 3.5.5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.5.2.

    Tickera Tickera
  • Medium 5.9
    CVE-2025-30847

    WordPress Novelist plugin <= 1.2.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashley Novelist novelist allows Stored XSS.This issue affects Novelist: from n/a through <= 1.2.3.

    Ashley Novelist
  • Medium 5.3
    CVE-2025-30839

    WordPress Taxi Booking Manager for WooCommerce plugin <= 1.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Taxi Booking Manager for WooCommerce: from n/a thro…

    MagePeople Team Taxi Booking Manager for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-30842

    WordPress Christmas Panda plugin <= 1.0.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in pixolette Christmas Panda christmas-panda allows Cross Site Request Forgery.This issue affects Christmas Panda: from n/a through <= 1.0.4.

    pixolette Christmas Panda
  • Medium 6.5
    CVE-2025-30838

    WordPress Cozy Blocks plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through <= 2.1.6.

    CozyThemes Cozy Blocks
  • Medium 6.5
    CVE-2025-30836

    WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint latepoint allows Stored XSS.This issue affects LatePoint: from n/a through <= 5.1.6.

    latepoint LatePoint
  • Medium 4.3
    CVE-2025-30833

    WordPress Verge3D Publishing and E-Commerce Plugin <= 4.8.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Soft8Soft LLC Verge3D verge3d allows Cross Site Request Forgery.This issue affects Verge3D: from n/a through <= 4.8.2.

    Soft8Soft Verge3D
  • Medium 6.5
    CVE-2025-30832

    WordPress Themify Event Post Plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Event Post themify-event-post allows DOM-Based XSS.This issue affects Themify Event Post: from n/a through <= 1.3.2.

    themifyme Themify Event Post
  • Medium 5.3
    CVE-2025-30830

    WordPress Cool Author Box plugin <= 2.9.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cool Author Box: from n/a through <= 2.9.9.

    Hossni Mubarak Cool Author Box
  • Medium 5.3
    CVE-2025-30828

    WordPress Timetics plugin <= 1.0.29 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.29.

    Arraytics Timetics
  • Medium 6.5
    CVE-2025-30826

    WordPress IP Locator plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pierre Lannoy IP Locator ip-locator allows DOM-Based XSS.This issue affects IP Locator: from n/a through <= 4.1.0.

    Pierre Lannoy IP Locator
  • Medium 5.4
    CVE-2025-30824

    WordPress Textmetrics plugin <= 3.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Israpil Textmetrics webtexttool allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Textmetrics: from n/a through <= 3.6.1.

    Israpil Textmetrics
  • Medium 4.3
    CVE-2025-30823

    WordPress Anthologize Plugin <= 0.8.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Boone Gorges Anthologize anthologize allows Cross Site Request Forgery.This issue affects Anthologize: from n/a through <= 0.8.2.

    Boone Gorges Anthologize
  • Medium 5.3
    CVE-2025-30821

    WordPress SNORDIAN's H5PxAPIkatchu plugin <= 0.4.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in otacke SNORDIAN's H5PxAPIkatchu h5pxapikatchu allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects SNORDIAN's H5PxAPIkatchu: from n/a through <= 0.4.14.

    otacke SNORDIAN's H5PxAPIkatchu
  • Medium 4.3
    CVE-2025-30822

    WordPress Custom Login Logo Plugin <= 1.1.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Hakik Zaman Custom Login Logo ideal-wp-login-logo-changer allows Cross Site Request Forgery.This issue affects Custom Login Logo: from n/a through <= 1.1.7.

    Hakik Zaman Custom Login Logo
  • Medium 6.5
    CVE-2025-30818

    WordPress jAlbum Bridge plugin <= 2.0.17 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mlaza jAlbum Bridge jalbum-bridge allows DOM-Based XSS.This issue affects jAlbum Bridge: from n/a through <= 2.0.17.

    mlaza jAlbum Bridge
  • Medium 5.4
    CVE-2025-30817

    WordPress Z Companion plugin <= 1.0.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpzita Z Companion z-companion allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Z Companion: from n/a through <= 1.0.13.

    wpzita Z Companion
  • Medium 4.3
    CVE-2025-30816

    WordPress publish post email notification plugin <= 1.0.2.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Nks publish post email notification publish-post-email-notification allows Cross Site Request Forgery.This issue affects publish post email notification: from n/a through <= 1.0.2.3.

    Nks publish post email notification
  • Medium 4.3
    CVE-2025-30815

    WordPress Hesabfa Accounting plugin <= 2.1.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Cross Site Request Forgery.This issue affects Hesabfa Accounting: from n/a through <= 2.1.8.

    Saeed Sattar Beglou Hesabfa Accounting
  • Medium 6.5
    CVE-2025-30813

    WordPress Listamester plugin <= 2.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in listamester Listamester listamester allows Stored XSS.This issue affects Listamester: from n/a through <= 2.3.5.

    listamester Listamester
  • Medium 6.5
    CVE-2025-30812

    WordPress SKT Addons for Elementor plugin <= 3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Addons for Elementor skt-addons-for-elementor allows Stored XSS.This issue affects SKT Addons for Elementor: from n/a through <= 3.5.

    sonalsinha21 SKT Addons for Elementor
  • Medium 4.3
    CVE-2025-30811

    WordPress ValidateCertify plugin <= 1.6.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Javier Revilla ValidateCertify validar-certificados-de-cursos allows Cross Site Request Forgery.This issue affects ValidateCertify: from n/a through <= 1.6.1.

    Javier Revilla ValidateCertify
  • Medium 5.4
    CVE-2025-30809

    WordPress WordPress Contact Form, Drag and Drop Form Builder Plugin – Live Forms plugin <= 4.8.4 - Settings Change vulnerability

    Missing Authorization vulnerability in Shahjada Live Forms liveforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Forms: from n/a through <= 4.8.4.

    Shahjada Live Forms
  • Medium 4.3
    CVE-2025-30805

    WordPress Flexible Cookies plugin <= 1.1.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wpdesk Flexible Cookies flexible-cookies allows Cross Site Request Forgery.This issue affects Flexible Cookies: from n/a through <= 1.1.8.

    WP Desk Flexible Cookies
  • Medium 4.3
    CVE-2025-30804

    WordPress wpShopGermany IT-RECHT KANZLEI plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in maennchen1.de wpShopGermany IT-RECHT KANZLEI wpshopgermany-it-recht-kanzlei allows Cross Site Request Forgery.This issue affects wpShopGermany IT-RECHT KANZLEI: from n/a through <= 2.0.

    maennchen1.de wpShopGermany IT-RECHT KANZLEI
  • Medium 4.3
    CVE-2025-30803

    WordPress Just Writing Statistics plugin <= 5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Greg Ross Just Writing Statistics just-writing-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Just Writing Statistics: from n/a through <= 5.3.

    Greg Ross Just Writing Statistics
  • Medium 4.3
    CVE-2025-30801

    WordPress TWB Woocommerce Reviews plugin <= 1.7.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Abu Bakar TWB Woocommerce Reviews twb-woocommerce-reviews allows Cross Site Request Forgery.This issue affects TWB Woocommerce Reviews: from n/a through <= 1.7.7.

    Abu Bakar TWB Woocommerce Reviews Web / CMS