Skip to content
OpenAdvisories

Archive

16 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /16 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

92 results · Clear filters · Feed

  • Medium 6.5
    CVE-2022-4363

    Wholesale Market <= 2.2.2 - Settings Update via CSRF

    The Wholesale Market WordPress plugin before 2.2.2, Wholesale Market for WooCommerce WordPress plugin before 2.0.1 have a flawed CSRF check when updating their settings, which could allow attackers to make a logged in admin update them via a CSRF attack

    Web / CMS
  • Medium 4.8
    CVE-2025-4805

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Acces Portal Configuration

    A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execu…

    WatchGuard Fireware OS
  • Medium 4.8
    CVE-2025-4804

    WatchGuard Firebox Stored Cross-Site-Scripting (XSS) Vulnerability in Hotpot Configuration

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally m…

    WatchGuard Fireware OS
  • Medium 6.3
    CVE-2025-4808

    PHPGurukul Park Ticketing Management System add-normal-ticket.php sql injection

    A vulnerability was found in PHPGurukul Park Ticketing Management System 2.0 and classified as critical. This issue affects some unknown processing of the file /add-normal-ticket.php. The manipulation of the argument noadult/nochildren/aprice/cprice leads to …

    PHPGurukul Park Ticketing Management System
  • Medium 5.3
    CVE-2025-4807

    SourceCodester Online Student Clearance System exposure of information through directory listing

    A vulnerability, which was classified as problematic, was found in SourceCodester Online Student Clearance System 1.0. This affects an unknown part. The manipulation leads to exposure of information through directory listing. It is possible to initiate the at…

    SourceCodester Online Student Clearance System
  • Medium 6.3
    CVE-2025-4806

    SourceCodester/oretnom23 Stock Management System view_bo sql injection

    A vulnerability, which was classified as critical, has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/?page=back_order/view_bo. The manipulation of the argument ID le…

    SourceCodester oretnom23 Stock Management System Stock Management System
  • Medium 4.7
    CVE-2025-4795

    gongfuxiang schoolcms index.php SaveInfo sql injection

    A vulnerability classified as critical has been found in gongfuxiang schoolcms 2.3.1. This affects the function SaveInfo of the file /index.php?m=Admin&c=article&a=SaveInfo. The manipulation of the argument ID leads to sql injection. It is possible to initiat…

    gongfuxiang schoolcms
  • Medium 4.3
    CVE-2025-4476 Public exploit

    Libsoup: null pointer dereference in libsoup may lead to denial of service

    A denial-of-service vulnerability has been identified in the libsoup HTTP client library. This flaw can be triggered when a libsoup client receives a 401 (Unauthorized) HTTP response containing a specifically crafted domain parameter within the WWW-Authentica…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2025-4787

    SourceCodester/oretnom23 Stock Management System view_sale sql injection

    A vulnerability classified as critical has been found in SourceCodester/oretnom23 Stock Management System 1.0. Affected is an unknown function of the file /admin/?page=sales/view_sale. The manipulation of the argument ID leads to sql injection. It is possible…

    SourceCodester oretnom23 Stock Management System Stock Management System
  • Medium 4.3
    CVE-2025-31062

    WordPress Wishlist plugin <= 2.1.0 - Sensitive Data Exposure Vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in redqteam Wishlist wishlist allows Retrieve Embedded Sensitive Data.This issue affects Wishlist: from n/a through <= 2.1.0.

    redqteam Wishlist
  • Medium 4.3
    CVE-2025-31063

    WordPress Wishlist plugin <= 2.1.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in redqteam Wishlist wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist: from n/a through <= 2.1.0.

    redqteam Wishlist
  • Medium 5.3
    CVE-2025-31065

    WordPress Rozario <= 1.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton Rozario allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Rozario: from n/a through 1.4.

    Themeton Rozario
  • Medium 5.3
    CVE-2025-31066

    WordPress Acerola theme <= 1.6.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton Acerola acerola allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Acerola: from n/a through <= 1.6.5.

    Themeton Acerola
  • Medium 4.3
    CVE-2025-31068

    WordPress Seven Stars <= 1.4.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themeton Seven Stars allows Cross Site Request Forgery. This issue affects Seven Stars: from n/a through 1.4.4.

    Themeton Seven Stars
  • Medium 5.3
    CVE-2025-31630

    WordPress The Business <= 1.6.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton The Business allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects The Business: from n/a through 1.6.1.

    Themeton The Business
  • Medium 5.3
    CVE-2025-31071

    WordPress HotStar – Multi-Purpose Business Theme <= 1.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeton HotStar – Multi-Purpose Business Theme allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects HotStar – Multi-Purpose Business Theme: from n/a through 1.4.

    Themeton HotStar – Multi-Purpose Business Theme
  • Medium 4.3
    CVE-2025-31639

    WordPress Spare <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themeton Spare allows Cross Site Request Forgery. This issue affects Spare: from n/a through 1.7.

    Themeton Spare
  • Medium 4.3
    CVE-2025-31921

    WordPress WP Ultimate Tours Builder plugin <= 1.055 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Ultimate Tours Builder WP_UltimateToursBuilder allows Cross Site Request Forgery.This issue affects WP Ultimate Tours Builder: from n/a through <= 1.055.

    loopus WP Ultimate Tours Builder
  • Medium 5.4
    CVE-2025-31915

    WordPress Pixel Form BuilderPlugin & Autoresponder plugin <= 1.0.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder pixel-formbuilder allows Cross Site Request Forgery.This issue affects Pixel WordPress Form BuilderPlugin & Autoresponder: from n/a through <= 1…

    kamleshyadav Pixel WordPress Form BuilderPlugin & Autoresponder Web / CMS
  • Medium 5.4
    CVE-2025-31923

    WordPress CSS3 Accordions for WordPress plugin <= 3.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in QuanticaLabs CSS3 Accordions for WordPress css3_accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Accordions for WordPress: from n/a through <= 3.0.

    QuanticaLabs CSS3 Accordions for WordPress Web / CMS
  • Medium 6.5
    CVE-2025-32180

    WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/…

    MojofyWP Product Carousel For WooCommerce – WoorouSell Web / CMS
  • Medium 4.3
    CVE-2025-32295

    WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through <= 10.10.2.

    wordpresschef Salon Booking Pro Web / CMS
  • Medium 4.3
    CVE-2025-32299

    WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure Vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Ca…

    Themovation QuickCal - Appointment Booking Calendar for WordPress Web / CMS
  • Medium 5.3
    CVE-2025-32296

    WordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through < 14.8.1.

    Quantum Cloud Simple Link Directory
  • Medium 4.3
    CVE-2025-39482

    WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.

    imithemes Eventer
  • Medium 4.3
    CVE-2025-39493

    WordPress Rankie plugin < 1.8.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rankie: from n/a through < 1.8.2.

    ValvePress Rankie
  • Medium 6.5
    CVE-2025-39509

    WordPress TNC FlipBook plugin <= 12.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows Stored XSS.This issue affects TNC FlipBook: from n/a through <= 12.1.0.

    ThemeNcode TNC FlipBook
  • Medium 4.3
    CVE-2025-39511

    WordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/a through <= 4.19.0.

    ValvePress Pinterest Automatic Pin
  • Medium 6.5
    CVE-2025-46464

    WordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.This issue affects Ads Pro: from n/a through <= 5.0.

    scripteo Ads Pro
  • Medium 5.4
    CVE-2025-47556

    WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Compare Pricing Tables for WordPress: f…

    QuanticaLabs CSS3 Compare Pricing Tables for WordPress Web / CMS
  • Medium 4.3
    CVE-2025-47534

    WordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.

    ValvePress Wordpress Auto Spinner Web / CMS
  • Medium 5.0
    CVE-2025-47560

    WordPress MapSVG plugin < 8.6.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through < 8.6.13.

    RomanCode MapSVG
  • Medium 6.5
    CVE-2025-47557

    WordPress MapSVG plugin <= 8.5.31 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affects MapSVG: from n/a through <= 8.5.31.

    RomanCode MapSVG
  • Medium 5.3
    CVE-2025-47563

    WordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerability

    Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CURCY: from n/a through <= 2.3.7.

    villatheme CURCY
  • Medium 5.3
    CVE-2025-47562

    WordPress MapSVG plugin <= 8.5.34 - Content Injection Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg allows Code Injection.This issue affects MapSVG: from n/a through <= 8.5.34.

    RomanCode MapSVG
  • Medium 5.3
    CVE-2025-47564

    WordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8.

    Ashan Jay EventON
  • Medium 4.3
    CVE-2025-48138

    WordPress BERTHA AI plugin <= 1.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.

    Bertha AI – Andrew Palmer BERTHA AI
  • Medium 6.5
    CVE-2025-48135

    WordPress Aptivada for WP plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-for-wp allows DOM-Based XSS.This issue affects Aptivada for WP: from n/a through <= 2.0.0.

    aptivadadev Aptivada for WP
  • Medium 6.5
    CVE-2025-48132

    WordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Stored XSS.This issue affects X Addons for Elementor: from n/a through <= 1.0.16.

    pencilwp X Addons for Elementor
  • Medium 6.5
    CVE-2025-48131

    WordPress UltraAddons Elementor Lite plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Stored XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.

    Saiful Islam UltraAddons Elementor Lite