Skip to content
OpenAdvisories

Archive

7 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /7 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

205 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-47486

    WordPress Gutenberg & Elementor Templates Importer For Responsive plugin <= 3.1.9 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Responsive Plus: from n/a through <= 3.1.9.

    cyberchimps Responsive Plus
  • Medium 6.4
    CVE-2025-47484

    WordPress Display Remote Posts Block plugin <= 1.1.0 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Oliver Campion Display Remote Posts Block display-remote-posts-block allows Server Side Request Forgery.This issue affects Display Remote Posts Block: from n/a through <= 1.1.0.

    Oliver Campion Display Remote Posts Block
  • Medium 5.3
    CVE-2025-47485

    WordPress Cozy Blocks plugin <= 2.1.22 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cozy Blocks: from n/a through <= 2.1.22.

    CozyThemes Cozy Blocks
  • Medium 4.9
    CVE-2025-47483

    WordPress Easy Replace Image plugin <= 3.5.0 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Iulia Cazan Easy Replace Image easy-replace-image allows Server Side Request Forgery.This issue affects Easy Replace Image: from n/a through <= 3.5.0.

    Iulia Cazan Easy Replace Image
  • Medium 6.5
    CVE-2025-47482

    WordPress SKT Skill Bar plugin <= 2.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Skill Bar skt-skill-bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through <= 2.4.

    sonalsinha21 SKT Skill Bar
  • Medium 5.3
    CVE-2025-47481

    WordPress GS Testimonial Slider plugin <= 3.2.9 - Content Injection vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Code Injection.This issue affects GS Testimonial Slider: from n/a through <= 3.2.9.

    GS Plugins GS Testimonial Slider
  • Medium 6.5
    CVE-2025-47476

    WordPress Cost Calculator for Elementor plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org Cost Calculator for Elementor cost-calculator-for-elementor allows DOM-Based XSS.This issue affects Cost Calculator for Elementor: from n/a throu…

    add-ons.org Cost Calculator for Elementor
  • Medium 5.4
    CVE-2025-47480

    WordPress Graphina plugin <= 3.0.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Iqonic Design Graphina graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina: from n/a through <= 3.0.4.

    Iqonic Design Graphina
  • Medium 6.5
    CVE-2025-47475

    WordPress JupiterX Core plugin <= 4.8.11 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artbees JupiterX Core jupiterx-core allows Stored XSS.This issue affects JupiterX Core: from n/a through <= 4.8.11.

    artbees JupiterX Core
  • Medium 5.4
    CVE-2025-47473

    WordPress PW WooCommerce Bulk Edit plugin <= 2.134 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in pimwick PW WooCommerce Bulk Edit pw-bulk-edit allows Cross Site Request Forgery.This issue affects PW WooCommerce Bulk Edit: from n/a through <= 2.134.

    pimwick PW WooCommerce Bulk Edit Web / CMS
  • Medium 4.3
    CVE-2025-47471

    WordPress Envo Extra plugin <= 1.9.9 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in EnvoThemes Envo Extra envo-extra allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Envo Extra: from n/a through <= 1.9.9.

    EnvoThemes Envo Extra
  • Medium 5.4
    CVE-2025-47472

    WordPress Music Player for WooCommerce plugin <= 1.5.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in codepeople Music Player for WooCommerce music-player-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Music Player for WooCommerce: from n/a through <= 1.5.1.

    codepeople Music Player for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-47470

    WordPress GPT3 AI Content Writer plugin <= 1.9.14 - Cross Site Request Forgery (CSRF) to Prompt Generation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in senols GPT3 AI Content Writer gpt3-ai-content-generator allows Cross Site Request Forgery.This issue affects GPT3 AI Content Writer: from n/a through <= 1.9.14.

    senols GPT3 AI Content Writer
  • Medium 5.4
    CVE-2025-47469

    WordPress Media Hygiene plugin <= 4.0.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in slui Media Hygiene media-hygiene allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Media Hygiene: from n/a through <= 4.0.0.

    slui Media Hygiene
  • Medium 4.3
    CVE-2025-47468

    WordPress Hash Form plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in hashthemes Hash Form hash-form allows Cross Site Request Forgery.This issue affects Hash Form: from n/a through <= 1.2.8.

    HashThemes Hash Form
  • Medium 4.3
    CVE-2025-47467

    WordPress GS Testimonial Slider plugin <= 3.3.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in GS Plugins GS Testimonial Slider gs-testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Testimonial Slider: from n/a through <= 3.3.0.

    GS Plugins GS Testimonial Slider
  • Medium 4.9
    CVE-2025-47465

    WordPress Blocksy theme <= 2.0.97 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in creativethemeshq Blocksy blocksy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Blocksy: from n/a through <= 2.0.97.

    creativethemeshq Blocksy
  • Medium 5.4
    CVE-2025-47466

    WordPress Ultimate WP Mail plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.

    Rustaurius Ultimate WP Mail
  • Medium 4.9
    CVE-2025-47464

    WordPress Solace Extra plugin <= 1.3.1 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in solacewp Solace Extra solace-extra allows Server Side Request Forgery.This issue affects Solace Extra: from n/a through <= 1.3.1.

    solacewp Solace Extra
  • Medium 5.3
    CVE-2025-47457

    WordPress LocateAndFilter plugin <= 1.6.16 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in dgamoni LocateAndFilter locateandfilter allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects LocateAndFilter: from n/a through <= 1.6.16.

    dgamoni LocateAndFilter
  • Medium 4.3
    CVE-2025-47459

    WordPress WP Fundraising Donation and Crowdfunding Platform plugin <= 1.7.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Roxnor FundEngine wp-fundraising-donation allows Cross Site Request Forgery.This issue affects FundEngine: from n/a through <= 1.7.3.

    roxnor FundEngine
  • Medium 4.7
    CVE-2025-47456

    WordPress WP Gravity Forms Zendesk plugin <= 1.1.2 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Zendesk gf-zendesk allows Phishing.This issue affects WP Gravity Forms Zendesk: from n/a through <= 1.1.2.

    CRM Perks WP Gravity Forms Zendesk
  • Medium 4.7
    CVE-2025-47455

    WordPress Integration for WooCommerce and Salesforce plugin <= 1.7.5 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for WooCommerce and Salesforce woo-salesforce-plugin-crm-perks allows Phishing.This issue affects Integration for WooCommerce and Salesforce: from n/a through <= 1.7.5.

    CRM Perks Integration for WooCommerce and Salesforce Web / CMS
  • Medium 4.3
    CVE-2025-47451

    WordPress Product Quantity Dropdown For Woocommerce plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Product Quantity Dropdown For Woocommerce product-quantity-dropdown-for-woocommerce allows Cross Site Request Forgery.This issue affects Product Quantity Dropdown For Woocommerce: from n/a th…

    silverplugins217 Product Quantity Dropdown For Woocommerce Web / CMS
  • Medium 4.7
    CVE-2025-47454

    WordPress WP Gravity Forms Dynamics CRM plugin <= 1.1.4 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Dynamics CRM gf-dynamics-crm allows Phishing.This issue affects WP Gravity Forms Dynamics CRM: from n/a through <= 1.1.4.

    CRM Perks WP Gravity Forms Dynamics CRM
  • Medium 5.9
    CVE-2025-47449

    WordPress Meow Gallery plugin <= 5.2.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Meow Gallery meow-gallery allows Stored XSS.This issue affects Meow Gallery: from n/a through <= 5.2.7.

    Jordy Meow Meow Gallery
  • Medium 5.3
    CVE-2025-47450

    WordPress Simple File List plugin <= 6.1.13 - Settings Change Vulnerability

    Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.13.

    Mitchell Bennis Simple File List
  • Medium 4.3
    CVE-2025-47448

    WordPress WP Hotel Booking plugin <= 2.1.9 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThimPress WP Hotel Booking wp-hotel-booking allows Cross Site Request Forgery.This issue affects WP Hotel Booking: from n/a through <= 2.1.9.

    ThimPress WP Hotel Booking
  • Medium 4.3
    CVE-2025-47447

    WordPress Cool Author Box plugin <= 3.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Hossni Mubarak Cool Author Box hm-cool-author-box-widget allows Cross Site Request Forgery.This issue affects Cool Author Box: from n/a through <= 3.0.0.

    Hossni Mubarak Cool Author Box
  • Medium 4.3
    CVE-2025-47446

    WordPress Listamester plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in listamester Listamester listamester allows Cross Site Request Forgery.This issue affects Listamester: from n/a through <= 2.3.6.

    listamester Listamester
  • Medium 6.5
    CVE-2025-47442

    WordPress CC BMI Calculator plugin <= 2.1.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CC CC BMI Calculator cc-bmi-calculator allows Stored XSS.This issue affects CC BMI Calculator: from n/a through <= 2.1.0.

    CC CC BMI Calculator
  • Medium 6.5
    CVE-2025-47443

    WordPress Widget Countdown plugin <= 2.7.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdevart Widget Countdown widget-countdown allows Stored XSS.This issue affects Widget Countdown: from n/a through <= 2.7.4.

    wpdevart Widget Countdown
  • Medium 6.5
    CVE-2025-47441

    WordPress Progress Bar plugin <= 2.2.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Reynolds Progress Bar progress-bar allows Stored XSS.This issue affects Progress Bar: from n/a through <= 2.2.3.

    Chris Reynolds Progress Bar
  • Medium 6.5
    CVE-2025-39361

    WordPress Royal Elementor Addons plugin <= 1.7.1017 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through <= 1.7.1017.

    WP Royal Royal Elementor Addons
  • Medium 6.9
    CVE-2025-27533 Public exploit

    Apache ActiveMQ: Unchecked buffer length can cause excessive memory allocation

    Memory Allocation with Excessive Size Value vulnerability in Apache ActiveMQ. During unmarshalling of OpenWire commands the size value of buffers was not properly validated which could lead to excessive memory allocation and be exploited to cause a denial of …

    Apache Software Foundation Apache ActiveMQ zipkin zipkin-slim Debian Ubuntu Wolfi Maven
  • Medium 4.0
    CVE-2025-20980

    Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to cause memory corruption.

    Samsung Mobile libsavscmn
  • Medium 6.2
    CVE-2025-20978

    Improper access control in PENUP prior to version 3.9.19.32 allows local attackers to access files with PENUP privilege.

    Samsung Mobile PENUP
  • Medium 5.5
    CVE-2025-20976

    Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.29.23 allows attackers to r…

    Samsung Mobile Samsung Notes
  • Medium 5.5
    CVE-2025-20975

    Improper Export of Android Application Components in AODService prior to version 8.8.28.12 allows local attackers to la…

    Samsung Mobile AODService
  • Medium 6.1
    CVE-2025-20974

    Improper handling of insufficient permission in PackageInstallerCN prior to version 15.0.11.0 allows local attacker to …

    Samsung Mobile PackageInstallerCN