Skip to content
OpenAdvisories

Archive

16 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /16 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

172 results · Feed

  • High 7.1
    CVE-2025-32245

    WordPress Featured Posts Scroll plugin <= 1.25 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Chaser324 Featured Posts Scroll featured-posts-scroll allows Stored XSS.This issue affects Featured Posts Scroll: from n/a through <= 1.25.

    Chaser324 Featured Posts Scroll
  • Medium 6.5
    CVE-2025-32180

    WordPress Product Carousel For WooCommerce – WoorouSell plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojofywp Product Carousel For WooCommerce – WoorouSell woorousell allows Stored XSS.This issue affects Product Carousel For WooCommerce – WoorouSell: from n/…

    MojofyWP Product Carousel For WooCommerce – WoorouSell Web / CMS
  • High 8.5
    CVE-2025-32287

    WordPress Responsive HTML5 Audio Player PRO With Playlist plugin <= 3.5.7 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows SQL Injection.This issue affects Responsive HTML5 Audio Player PRO With …

    LambertGroup Responsive HTML5 Audio Player PRO With Playlist
  • High 8.5
    CVE-2025-32290

    WordPress Sticky HTML5 Music Player plugin <= 3.1.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Sticky HTML5 Music Player lbg-audio3-html5 allows SQL Injection.This issue affects Sticky HTML5 Music Player: from n/a through <= 3.1.6.

    LambertGroup Sticky HTML5 Music Player
  • Medium 4.3
    CVE-2025-32295

    WordPress Salon Booking Wordpress plugin <= 10.10.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wordpresschef Salon Booking Pro salon-booking-plugin-pro-cc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Salon Booking Pro: from n/a through <= 10.10.2.

    wordpresschef Salon Booking Pro Web / CMS
  • Medium 4.3
    CVE-2025-32299

    WordPress QuickCal plugin <= 1.0.15 - Sensitive Data Exposure Vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Themovation QuickCal - Appointment Booking Calendar for WordPress quickcal allows Retrieve Embedded Sensitive Data.This issue affects QuickCal - Appointment Booking Ca…

    Themovation QuickCal - Appointment Booking Calendar for WordPress Web / CMS
  • Medium 5.3
    CVE-2025-32296

    WordPress Simple Link Directory Pro plugin < 14.8.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through < 14.8.1.

    Quantum Cloud Simple Link Directory
  • High 8.5
    CVE-2025-32301

    WordPress CountDown Pro WP Plugin <= 2.7 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown Pro WP Plugin circular_countdown allows SQL Injection.This issue affects CountDown Pro WP Plugin: from n/a through <= 2.7.

    LambertGroup CountDown Pro WP Plugin
  • High 8.5
    CVE-2025-32306

    WordPress Radio Player Shoutcast & Icecast theme <= 4.4.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin audio4-html5 allows Blind SQL Injection.This issue affects Radio Player Shoutcast & Icecast Wo…

    LambertGroup Radio Player Shoutcast & Icecast WordPress Plugin Web / CMS
  • High 8.5
    CVE-2025-32307

    WordPress Chameleon HTML5 Audio Player With/Without Playlist plugin <= 3.5.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Chameleon HTML5 Audio Player With/Without Playlist lbg-audio1-html5 allows SQL Injection.This issue affects Chameleon HTML5 Audio Player With/Wi…

    LambertGroup Chameleon HTML5 Audio Player With/Without Playlist
  • High 8.8
    CVE-2025-32310

    WordPress QuickCal plugin <= 1.0.15 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ThemeMove QuickCal - Appointment Booking Calendar for WordPress quickcal allows Privilege Escalation.This issue affects QuickCal - Appointment Booking Calendar for WordPress: from n/a through <= 1.0.15.

    ThemeMove QuickCal - Appointment Booking Calendar for WordPress Web / CMS
  • Critical 9.3
    CVE-2025-39481

    WordPress Eventer plugin < 3.11.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in imithemes Eventer eventer allows Blind SQL Injection.This issue affects Eventer: from n/a through < 3.11.4.

    imithemes Eventer
  • Critical 9.3
    CVE-2025-32643

    WordPress WPGYM Plugin <= 65.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPGYM allows Blind SQL Injection. This issue affects WPGYM: from n/a through 65.0.

    mojoomla WPGYM
  • Medium 4.3
    CVE-2025-39482

    WordPress Eventer plugin < 3.11.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in imithemes Eventer eventer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventer: from n/a through < 3.11.4.

    imithemes Eventer
  • High 8.1
    CVE-2025-39491

    WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability

    Path Traversal vulnerability in WHMPress WHMpress allows Path Traversal. This issue affects WHMpress: from 6.2 through revision.

    WHMPress WHMpress
  • High 7.5
    CVE-2025-39492

    WordPress WHMpress plugin <= 6.2-revision-9 - Local File Inclusion vulnerability

    Path Traversal vulnerability in WHMPress WHMpress allows Relative Path Traversal. This issue affects WHMpress: from 6.2 through revision.

    WHMPress WHMpress
  • Medium 4.3
    CVE-2025-39493

    WordPress Rankie plugin < 1.8.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ValvePress Rankie valvepress-rankie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rankie: from n/a through < 1.8.2.

    ValvePress Rankie
  • High 7.5
    CVE-2025-39507 Public exploit

    WordPress Nasa Core Plugin <= 6.4.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through < 6.4.4.

    NasaTheme Nasa Core
  • Medium 6.5
    CVE-2025-39509

    WordPress TNC FlipBook plugin <= 12.1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNcode TNC FlipBook pdf-viewer-for-wordpress allows Stored XSS.This issue affects TNC FlipBook: from n/a through <= 12.1.0.

    ThemeNcode TNC FlipBook
  • Medium 4.3
    CVE-2025-39511

    WordPress Pinterest Automatic Pin plugin <= 4.19.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ValvePress Pinterest Automatic Pin wp-pinterest-automatic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinterest Automatic Pin: from n/a through <= 4.19.0.

    ValvePress Pinterest Automatic Pin
  • High 7.1
    CVE-2025-39537

    WordPress Better Customer List for WooCommerce Plugin <= 1.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blaze Concepts Better Customer List for WooCommerce woo-better-customer-list allows Reflected XSS.This issue affects Better Customer List for WooCommerce: fr…

    Blaze Concepts Better Customer List for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-46464

    WordPress Ads Pro plugin <= 5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows Stored XSS.This issue affects Ads Pro: from n/a through <= 5.0.

    scripteo Ads Pro
  • Medium 5.4
    CVE-2025-47556

    WordPress CSS3 Compare Pricing Tables for WordPress plugin <= 11.6 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in QuanticaLabs CSS3 Compare Pricing Tables for WordPress css3_web_pricing_tables_grids allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CSS3 Compare Pricing Tables for WordPress: f…

    QuanticaLabs CSS3 Compare Pricing Tables for WordPress Web / CMS
  • Medium 4.3
    CVE-2025-47534

    WordPress Wordpress Auto Spinner plugin <= 3.25.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ValvePress Wordpress Auto Spinner wp-auto-spinner allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wordpress Auto Spinner: from n/a through <= 3.25.0.

    ValvePress Wordpress Auto Spinner Web / CMS
  • Medium 5.0
    CVE-2025-47560

    WordPress MapSVG plugin < 8.6.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in RomanCode MapSVG mapsvg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MapSVG: from n/a through < 8.6.13.

    RomanCode MapSVG
  • Medium 6.5
    CVE-2025-47557

    WordPress MapSVG plugin <= 8.5.31 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RomanCode MapSVG mapsvg allows Stored XSS.This issue affects MapSVG: from n/a through <= 8.5.31.

    RomanCode MapSVG
  • Medium 5.3
    CVE-2025-47563

    WordPress CURCY plugin <= 2.3.7 - Arbitrary Shortcode Execution vulnerability

    Missing Authorization vulnerability in villatheme CURCY woocommerce-multi-currency allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects CURCY: from n/a through <= 2.3.7.

    villatheme CURCY
  • Medium 5.3
    CVE-2025-47562

    WordPress MapSVG plugin <= 8.5.34 - Content Injection Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in RomanCode MapSVG mapsvg allows Code Injection.This issue affects MapSVG: from n/a through <= 8.5.34.

    RomanCode MapSVG
  • High 7.6
    CVE-2025-47567

    WordPress Video Player & FullScreen Video Background plugin <= 2.4.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup Video Player & FullScreen Video Background universal-video-player-and-bg allows Blind SQL Injection.This issue affects Video Player & FullScreen…

    LambertGroup Video Player & FullScreen Video Background
  • Medium 5.3
    CVE-2025-47564

    WordPress EventON plugin <= 4.9.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ashanjay EventON eventon allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects EventON: from n/a through <= 4.9.8.

    Ashan Jay EventON
  • High 7.5
    CVE-2025-47693

    WordPress Fat Services Booking plugin <= 5.5 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Services Booking fat-services-booking allows PHP Local File Inclusion.This issue affects FAT Services Booking: from n/a throug…

    roninwp FAT Services Booking
  • High 7.1
    CVE-2025-48146

    WordPress SEO Flow by LupsOnline plugin <= 2.2.1 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Lups SEO Flow by LupsOnline lupsonline-link-netwerk allows Stored XSS.This issue affects SEO Flow by LupsOnline: from n/a through <= 2.2.1.

    Michael Lups SEO Flow by LupsOnline
  • High 7.1
    CVE-2025-48144

    WordPress Import Export For WooCommerce plugin <= 1.6.2 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sidngr Import Export For WooCommerce import-export-for-woocommerce allows Stored XSS.This issue affects Import Export For WooCommerce: from n/a through <= 1.6.2.

    sidngr Import Export For WooCommerce Web / CMS
  • High 8.5
    CVE-2025-48137

    WordPress Interview plugin <= 1.01 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in proxymis Interview interview allows SQL Injection.This issue affects Interview: from n/a through <= 1.01.

    proxymis Interview
  • Medium 4.3
    CVE-2025-48138

    WordPress BERTHA AI plugin <= 1.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BERTHA AI: from n/a through <= 1.13.

    Bertha AI – Andrew Palmer BERTHA AI
  • High 7.5
    CVE-2025-48136

    WordPress Mortgage Calculator Estatik plugin <= 2.0.12 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Estatik Mortgage Calculator Estatik estatik-mortgage-calculator allows PHP Local File Inclusion.This issue affects Mortgage Calculator Est…

    Estatik Mortgage Calculator Estatik
  • Medium 6.5
    CVE-2025-48135

    WordPress Aptivada for WP plugin <= 2.0.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aptivadadev Aptivada for WP aptivada-for-wp allows DOM-Based XSS.This issue affects Aptivada for WP: from n/a through <= 2.0.0.

    aptivadadev Aptivada for WP
  • Medium 6.5
    CVE-2025-48132

    WordPress X Addons for Elementor plugin <= 1.0.16 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pencilwp X Addons for Elementor x-addons-elementor allows Stored XSS.This issue affects X Addons for Elementor: from n/a through <= 1.0.16.

    pencilwp X Addons for Elementor
  • High 7.2
    CVE-2025-48134

    WordPress WP Tabs plugin <= 2.2.12 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ShapedPlugin LLC WP Tabs wp-expand-tabs-free allows Object Injection.This issue affects WP Tabs: from n/a through <= 2.2.12.

    ShapedPlugin WP Tabs
  • Medium 6.5
    CVE-2025-48131

    WordPress UltraAddons Elementor Lite plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saiful Islam UltraAddons Elementor Lite ultraaddons-elementor-lite allows Stored XSS.This issue affects UltraAddons Elementor Lite: from n/a through <= 2.0.2.

    Saiful Islam UltraAddons Elementor Lite