Skip to content
OpenAdvisories

Archive

19 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /19 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

107 results · Clear filters · Feed

  • High 8.7
    CVE-2025-3079

    A passback vulnerability which relates to office/small office multifunction printers and laser printers.

    Canon imageRUNNER Series imageCLASS Series Satera Series
  • High 8.7
    CVE-2025-3078

    A passback vulnerability which relates to production printers and office multifunction printers.

    Canon imageRUNNER Series imageRUNNER ADVANCE Series imageCLASS Series
  • High 8.5
    CVE-2025-4971 Public exploit

    Broadcom Automic Automation Agent Unix privilege escalation

    Broadcom Automic Automation Agent Unix versions < 24.3.0 HF4 and < 21.0.13 HF1 allow low privileged users who have execution rights on the agent executable to escalate their privileges.

    Broadcom Automic Automation
  • High 8.4
    CVE-2025-1308

    PX Backup Improper Sanitization Vulnerability

    A vulnerability exists in PX Backup whereby sensitive information may be logged under specific conditions.

    Pure Storage PX Backup
  • High 7.1
    CVE-2025-31027

    WordPress Tiger theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jocoxdesign Tiger tiger allows Reflected XSS.This issue affects Tiger: from n/a through 2.0.

    jocoxdesign Tiger
  • High 8.5
    CVE-2025-32924

    WordPress Revy plugin <= 2.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp Revy revy allows SQL Injection.This issue affects Revy: from n/a through <= 2.1.

    roninwp Revy
  • High 8.3
    CVE-2025-32925

    WordPress SUMO Reward Points plugin <= 30.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in FantasticPlugins SUMO Reward Points rewardsystem allows PHP Local File Inclusion.This issue affects SUMO Reward Points: from n/a through <…

    Fantastic Plugins SUMO Reward Points
  • High 8.2
    CVE-2025-39350

    WordPress wProject theme < 5.8.0 - Unauthenticated Post/Comment/Attachment Modification/Deletion vulnerability

    Missing Authorization vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.

    Rocket Apps wProject
  • High 8.2
    CVE-2025-39352

    WordPress Grand Restaurant WordPress theme <= 7.0 - Arbitrary Options Deletion vulnerability

    Missing Authorization vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Restaurant: from n/a through <= 7.0.

    ThemeGoods Grand Restaurant Web / CMS
  • High 8.5
    CVE-2025-39355

    WordPress FAT Services Booking plugin <= 5.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in roninwp FAT Services Booking fat-services-booking allows SQL Injection.This issue affects FAT Services Booking: from n/a through <= 5.6.

    roninwp FAT Services Booking
  • High 8.5
    CVE-2025-39357

    WordPress Hospital Management System plugin <= 47.0(20-11-2023) - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla Hospital Management System hospital-management allows SQL Injection.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-20…

    mojoomla Hospital Management System
  • High 7.1
    CVE-2025-39365

    WordPress wProject theme < 5.8.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps wProject allows Reflected XSS.This issue affects wProject: from n/a before 5.8.0.

    Rocket Apps wProject
  • High 8.8
    CVE-2025-39366

    WordPress wProject theme < 5.8.0 - Subscriber+ Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in Rocket Apps wProject.This issue affects wProject: from n/a before 5.8.0.

    Rocket Apps wProject
  • High 7.1
    CVE-2025-39372

    WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Reflected XSS.This issue affects WordPress Events Calendar Registration & Ticke…

    elbisnero WordPress Events Calendar Registration & Tickets Web / CMS
  • High 7.1
    CVE-2025-39392

    WordPress WPAMS plugin <= 44.0 (17-08-2023) - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla WPAMS apartment-management allows Reflected XSS.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

    mojoomla WPAMS
  • High 7.1
    CVE-2025-39393

    WordPress Hospital Management System plugin <= 47.0(20-11-2023) - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mojoomla Hospital Management System hospital-management allows Reflected XSS.This issue affects Hospital Management System: from n/a through <= 47.0(20-11-20…

    mojoomla Hospital Management System
  • High 7.5
    CVE-2025-47944

    Multer vulnerable to Denial of Service from maliciously crafted requests

    Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload requ…

    expressjs multer grafana-image-renderer multer Wolfi npm
  • High 7.5
    CVE-2025-47935

    Multer vulnerable to Denial of Service via memory leaks from unclosed streams

    Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream…

    expressjs multer grafana-image-renderer multer Wolfi npm
  • High 8.5
    CVE-2025-39403

    WordPress WPAMS plugin <= 44.0 (17-08-2023) - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mojoomla WPAMS apartment-management allows SQL Injection.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

    mojoomla WPAMS
  • High 8.8
    CVE-2025-39405

    WordPress WPAMS plugin <= 44.0 (17-08-2023) - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in mojoomla WPAMS apartment-management allows Privilege Escalation.This issue affects WPAMS: from n/a through <= 44.0 (17-08-2023).

    mojoomla WPAMS
  • High 7.1
    CVE-2025-39407

    WordPress Memberpress plugin < 1.12.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Caseproof, LLC Memberpress allows Reflected XSS.This issue affects Memberpress: from n/a before 1.12.0.

    Caseproof Memberpress
  • High 7.1
    CVE-2025-39409

    WordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20…

    pressaholic WordPress Video Robot - The Ultimate Video Importer Web / CMS
  • High 7.5
    CVE-2025-39411

    WordPress WhatsApp Click to Chat Plugin for WordPress plugin <= 2.2.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: fro…

    Indie_Plugins WhatsApp Click to Chat Plugin for WordPress Web / CMS
  • High 8.7
    CVE-2025-47934

    OpenPGP.js's message signature verification can be spoofed

    OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either `openpgp.verify` or `openpgp.decrypt`, causing these functions to retur…

    openpgpjs openpgpjs renovate openpgp Wolfi npm
  • High 7.1
    CVE-2025-39446

    WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4.

    Pluggabl Booster Plus for WooCommerce Web / CMS
  • High 7.5
    CVE-2025-39447

    WordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Crocoblock JetElements For Elementor jet-elements allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

    Crocoblock JetElements For Elementor
  • High 7.5
    CVE-2025-39449

    WordPress JetWooBuilder plugin <= 2.1.18 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetWooBuilder: from n/a through <= 2.1.18.

    Crocoblock JetWooBuilder
  • High 7.5
    CVE-2025-39451

    WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.

    Crocoblock JetBlocks For Elementor
  • High 8.1
    CVE-2025-39458

    WordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through <= 2.5.2.

    Mikado-Themes Foton
  • High 7.3
    CVE-2025-39459 Public exploit

    WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through <= 3.5.2.

    contempoinc Real Estate 7
  • High 7.1
    CVE-2025-43832

    WordPress Remote Images Grabber plugin <= 0.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through <= 0.6.

    andreyk Remote Images Grabber
  • High 7.1
    CVE-2025-43836

    WordPress Syndicate Out <= 0.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflected XSS.This issue affects Syndicate Out: from n/a through <= 0.9.

    confuzzledduck Syndicate Out
  • High 7.1
    CVE-2025-43837

    WordPress Total Donations <= 3.0.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected XSS.This issue affects Total Donations: from n/a through <= 3.0.8.

    binti76 Total Donations
  • High 7.1
    CVE-2025-43839

    WordPress BP Messages Tool plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflected XSS.This issue affects BP Messages Tool: from n/a through <= 2.2.

    shanebp BP Messages Tool
  • High 8.1
    CVE-2025-27010

    WordPress Tastyc < 2.5.2 - Local File Inclusion Vulnerability

    Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.

    bslthemes Tastyc
  • High 7.1
    CVE-2025-26997

    WordPress Wireless Butler plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler wireless-butler allows Reflected XSS.This issue affects Wireless Butler: from n/a through <= 1.0.11.

    validas Wireless Butler
  • High 7.5
    CVE-2025-26735

    WordPress Grip theme <= 1.0.9 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9.

    Candid themes Grip
  • High 7.6
    CVE-2025-43833

    WordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a through <= 1.1.1.

    Amir Helzer Absolute Links
  • High 7.5
    CVE-2025-39396

    WordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.

    Crocoblock JetReviews
  • High 7.1
    CVE-2025-43840

    WordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05.

    ref CheckBot