Skip to content
OpenAdvisories

Archive

19 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /19 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

244 results · Feed

  • High 7.1
    CVE-2025-39409

    WordPress WordPress Video Robot - The Ultimate Video Importer plugin <= 1.20.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pressaholic WordPress Video Robot - The Ultimate Video Importer.This issue affects WordPress Video Robot - The Ultimate Video Importer: from n/a through 1.20…

    pressaholic WordPress Video Robot - The Ultimate Video Importer Web / CMS
  • Critical 9.8
    CVE-2025-39410

    WordPress Smart Sections Theme Builder - WPBakery Page Builder Addon plugin <= 1.7.8 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon.This issue affects Smart Sections Theme Builder - WPBakery Page Builder Addon: from n/a through 1.7.8.

    themegusta Smart Sections Theme Builder - WPBakery Page Builder Addon
  • High 7.5
    CVE-2025-39411

    WordPress WhatsApp Click to Chat Plugin for WordPress plugin <= 2.2.12 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: fro…

    Indie_Plugins WhatsApp Click to Chat Plugin for WordPress Web / CMS
  • High 8.7
    CVE-2025-47934

    OpenPGP.js's message signature verification can be spoofed

    OpenPGP.js is a JavaScript implementation of the OpenPGP protocol. Startinf in version 5.0.1 and prior to versions 5.11.3 and 6.1.1, a maliciously modified message can be passed to either `openpgp.verify` or `openpgp.decrypt`, causing these functions to retur…

    openpgpjs openpgpjs renovate openpgp Wolfi npm
  • Critical 9.3
    CVE-2025-39445

    WordPress Super Store Finder <= 7.2 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp allows SQL Injection.This issue affects Super Store Finder: from n/a through <= 7.2.

    highwarden Super Store Finder
  • High 7.1
    CVE-2025-39446

    WordPress Booster Plus for WooCommerce plugin <= 7.2.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluggabl LLC Booster Plus for WooCommerce allows Reflected XSS.This issue affects Booster Plus for WooCommerce: from n/a through 7.2.4.

    Pluggabl Booster Plus for WooCommerce Web / CMS
  • Critical 9.9
    CVE-2025-47284

    Gardener vulnerable to metadata injection for a project secret that can lead to privilege escalation

    Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in the `gardenlet` component of Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0. It could allow a user wi…

    gardener gardener github.com/gardener/gardener Go
  • High 7.5
    CVE-2025-39447

    WordPress JetElements For Elementor plugin <= 2.7.4.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Crocoblock JetElements For Elementor jet-elements allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

    Crocoblock JetElements For Elementor
  • High 7.5
    CVE-2025-39449

    WordPress JetWooBuilder plugin <= 2.1.18 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetWooBuilder: from n/a through <= 2.1.18.

    Crocoblock JetWooBuilder
  • High 7.5
    CVE-2025-39451

    WordPress JetBlocks For Elementor plugin <= 1.3.16 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.16.

    Crocoblock JetBlocks For Elementor
  • High 8.1
    CVE-2025-39458

    WordPress Foton theme <= 2.5.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Foton foton allows PHP Local File Inclusion.This issue affects Foton: from n/a through <= 2.5.2.

    Mikado-Themes Foton
  • High 7.3
    CVE-2025-39459 Public exploit

    WordPress Real Estate 7 theme <= 3.5.2 - Privilege Escalation vulnerability

    Incorrect Privilege Assignment vulnerability in contempoinc Real Estate 7 realestate-7 allows Privilege Escalation.This issue affects Real Estate 7: from n/a through <= 3.5.2.

    contempoinc Real Estate 7
  • Critical 9.9
    CVE-2025-47283

    Bypassing project secret validation can lead to privilege escalation

    Gardener implements the automated management and operation of Kubernetes clusters as a service. A security vulnerability was discovered in Gardener prior to versions 1.116.4, 1.117.5, 1.118.2, and 1.119.0 that could allow a user with administrative privileges…

    gardener gardener github.com/gardener/gardener Go
  • High 7.1
    CVE-2025-43832

    WordPress Remote Images Grabber plugin <= 0.6 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andreyk Remote Images Grabber remote-images-grabber allows Reflected XSS.This issue affects Remote Images Grabber: from n/a through <= 0.6.

    andreyk Remote Images Grabber
  • High 7.1
    CVE-2025-43836

    WordPress Syndicate Out <= 0.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in confuzzledduck Syndicate Out syndicate-out allows Reflected XSS.This issue affects Syndicate Out: from n/a through <= 0.9.

    confuzzledduck Syndicate Out
  • High 7.1
    CVE-2025-43837

    WordPress Total Donations <= 3.0.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in binti76 Total Donations total-donations allows Reflected XSS.This issue affects Total Donations: from n/a through <= 3.0.8.

    binti76 Total Donations
  • Medium 6.5
    CVE-2025-43838

    WordPress Custom PC Builder Lite for WooCommerce <= 1.0.1 - Settings Change Vulnerability

    Missing Authorization vulnerability in ChoPlugins.com Custom PC Builder Lite for WooCommerce custom-pc-builder-lite-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom PC Builder Lite for WooCommer…

    ChoPlugins.com Custom PC Builder Lite for WooCommerce Web / CMS
  • High 7.1
    CVE-2025-43839

    WordPress BP Messages Tool plugin <= 2.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanebp BP Messages Tool bp-messages-tool allows Reflected XSS.This issue affects BP Messages Tool: from n/a through <= 2.2.

    shanebp BP Messages Tool
  • Critical 10.0
    CVE-2025-47577 Public exploit Scanner template

    WordPress TI WooCommerce Wishlist plugin <= 2.9.2 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Upload a Web Shell to a Web Server.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.9.2.

    templateinvaders TI WooCommerce Wishlist Web / CMS
  • Critical 9.8
    CVE-2025-47581

    WordPress WordPress Events Calendar Registration & Tickets plugin <= 2.6.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in elbisnero WordPress Events Calendar Registration & Tickets wpeventplus allows Object Injection.This issue affects WordPress Events Calendar Registration & Tickets: from n/a through <= 2.6.0.

    elbisnero WordPress Events Calendar Registration & Tickets Web / CMS
  • Critical 9.8
    CVE-2025-47582

    WordPress WPBot Pro Wordpress Chatbot <= 12.7.0 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in QuantumCloud WPBot Pro Wordpress Chatbot allows Object Injection.This issue affects WPBot Pro Wordpress Chatbot: from n/a through 12.7.0.

    Quantum Cloud WPBot Pro Wordpress Chatbot Web / CMS
  • High 8.1
    CVE-2025-27010

    WordPress Tastyc < 2.5.2 - Local File Inclusion Vulnerability

    Path Traversal: '.../...//' vulnerability in bslthemes Tastyc tastyc allows PHP Local File Inclusion.This issue affects Tastyc: from n/a through < 2.5.2.

    bslthemes Tastyc
  • High 7.1
    CVE-2025-26997

    WordPress Wireless Butler plugin <= 1.0.11 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in validas Wireless Butler wireless-butler allows Reflected XSS.This issue affects Wireless Butler: from n/a through <= 1.0.11.

    validas Wireless Butler
  • Critical 9.9
    CVE-2025-26892 Public exploit

    WordPress Celestial Aura plugin <= 2.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Celestial Aura allows Using Malicious Files.This issue affects Celestial Aura: from n/a through 2.2.

    dkszone Celestial Aura
  • Critical 9.9
    CVE-2025-26872

    WordPress Eximius theme <= 2.2 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in dkszone Eximius allows Using Malicious Files.This issue affects Eximius: from n/a through 2.2.

    dkszone Eximius
  • High 7.5
    CVE-2025-26735

    WordPress Grip theme <= 1.0.9 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Candid themes Grip.This issue affects Grip: from n/a through 1.0.9.

    Candid themes Grip
  • Medium 5.4
    CVE-2025-22287

    WordPress LTL Freight Quotes – FreightQuote Edition plugin <= 2.3.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in enituretechnology LTL Freight Quotes – FreightQuote Edition ltl-freight-quotes-freightquote-edition allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LTL Freight Quotes – FreightQ…

    Eniture technology LTL Freight Quotes – FreightQuote Edition
  • Critical 9.9
    CVE-2025-47282

    Malicious google credential in DNS secret can lead to privilege escalation

    Gardener External DNS Management is an environment to manage external DNS entries for a kubernetes cluster. A security vulnerability was discovered in Gardener's External DNS Management prior to version 0.23.6 that could allow a user with administrative privi…

    gardener external-dns-management github.com/gardener/gardener-extension-shoot-dns-service github.com/gardener/external-dns-management Go
  • Medium 6.5
    CVE-2025-39448

    WordPress JetElements For Elementor plugin <= 2.7.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.4.1.

    Crocoblock JetElements For Elementor
  • Medium 6.5
    CVE-2025-39450

    WordPress JetTabs plugin <= 2.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows DOM-Based XSS.This issue affects JetTabs: from n/a through <= 2.2.7.

    Crocoblock JetTabs
  • Medium 4.3
    CVE-2025-39454

    WordPress Name Directory plugin <= 1.30.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jeroen Peters Name Directory name-directory.This issue affects Name Directory: from n/a through <= 1.30.0.

    Jeroen Peters Name Directory
  • Medium 5.3
    CVE-2025-39460

    WordPress Eduma theme <= 5.6.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThimPress Eduma eduma allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eduma: from n/a through <= 5.6.4.

    ThimPress Eduma
  • High 7.6
    CVE-2025-43833

    WordPress Absolute Links plugin <= 1.1.1 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Amir Helzer Absolute Links absolute-links allows Blind SQL Injection.This issue affects Absolute Links: from n/a through <= 1.1.1.

    Amir Helzer Absolute Links
  • Medium 5.9
    CVE-2025-43834

    WordPress cookieBAR plugin <= 1.7.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tox82 cookieBAR cookiebar allows Stored XSS.This issue affects cookieBAR: from n/a through <= 1.7.0.

    tox82 cookieBAR
  • Medium 4.3
    CVE-2025-43835

    WordPress wp-cyr-cho plugin <= 0.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ktsvetkov wp-cyr-cho wp-cyr-cho allows Cross Site Request Forgery.This issue affects wp-cyr-cho: from n/a through <= 0.1.

    ktsvetkov wp-cyr-cho
  • Medium 4.3
    CVE-2025-39412

    WordPress Master Slider plugin <= 3.11.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in averta Master Slider master-slider.This issue affects Master Slider: from n/a through <= 3.11.0.

    Averta Master Slider
  • Medium 4.3
    CVE-2025-39398

    WordPress Hotel + Bed and Breakfast Booking Calendar Theme | Bellevue theme <= 4.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themovation Bellevue bellevuex.This issue affects Bellevue: from n/a through <= 4.2.2.

    Themovation Bellevue
  • High 7.5
    CVE-2025-39396

    WordPress JetReviews plugin <= 2.3.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetReviews jet-reviews allows PHP Local File Inclusion.This issue affects JetReviews: from n/a through <= 2.3.6.

    Crocoblock JetReviews
  • Medium 6.5
    CVE-2025-43841

    WordPress WP Vegas plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jamesdbruner WP Vegas vegas-fullscreen-background-slider allows Stored XSS.This issue affects WP Vegas: from n/a through <= 2.2.

    jamesdbruner WP Vegas
  • High 7.1
    CVE-2025-43840

    WordPress CheckBot plugin <= 1.05 - CSRF to Stored XSS vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ref CheckBot checkbot allows Stored XSS.This issue affects CheckBot: from n/a through <= 1.05.

    ref CheckBot