Skip to content
OpenAdvisories

Archive

23 May 2025

Vulnerabilities first published on this day (UTC), newest first.

← April 2025 2025 / May /23 June 2025 →
  1. 1372
  2. 2176
  3. 331
  4. 48
  5. 5127
  6. 6172
  7. 7308
  8. 8113
  9. 9152
  10. 1033
  11. 1128
  12. 12125
  13. 13312
  14. 14107
  15. 15309
  16. 16172
  17. 1751
  18. 1851
  19. 19244
  20. 20172
  21. 21114
  22. 22136
  23. 23183
  24. 2426
  25. 2520
  26. 2669
  27. 2795
  28. 2869
  29. 2978
  30. 30112
  31. 3137
All Critical High Medium Low Exploited only Public exploit

183 results · Feed

  • High 7.1
    CVE-2025-32285

    WordPress Butcher theme < 2.54 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ApusTheme Butcher butcher allows Reflected XSS.This issue affects Butcher: from n/a through < 2.54.

    ApusTheme Butcher
  • High 8.1
    CVE-2025-32286

    WordPress Butcher theme <= 2.40 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Butcher butcher allows PHP Local File Inclusion.This issue affects Butcher: from n/a through <= 2.40.

    ApusTheme Butcher
  • Critical 9.8
    CVE-2025-32292

    WordPress Jarvis – Night Club, Concert, Festival WordPress theme <= 1.8.11 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in AncoraThemes Jarvis – Night Club, Concert, Festival WordPress jarvis allows Object Injection.This issue affects Jarvis – Night Club, Concert, Festival WordPress: from n/a through <= 1.8.11.

    AncoraThemes Jarvis – Night Club, Concert, Festival WordPress Web / CMS
  • High 8.1
    CVE-2025-32289

    WordPress Yozi theme <= 2.0.63 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusTheme Yozi yozi allows PHP Local File Inclusion.This issue affects Yozi: from n/a through <= 2.0.63.

    ApusTheme Yozi
  • High 8.8
    CVE-2025-32293

    WordPress Finance Consultant theme <= 2.8 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in designthemes Finance Consultant finance allows Object Injection.This issue affects Finance Consultant: from n/a through <= 2.8.

    Design themes Finance Consultant
  • High 8.1
    CVE-2025-32294

    WordPress Oxpitan theme <= 1.3.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Oxpitan oxpitan allows PHP Local File Inclusion.This issue affects Oxpitan: from n/a through <= 1.3.5.

    gavias Oxpitan
  • High 8.1
    CVE-2025-32309

    WordPress Healsoul theme <= 2.2.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Healsoul healsoul allows PHP Local File Inclusion.This issue affects Healsoul: from n/a through <= 2.2.3.

    ThemeMove Healsoul
  • High 8.1
    CVE-2025-32302

    WordPress Winnex theme <= 1.3.2 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Winnex winnex allows PHP Local File Inclusion.This issue affects Winnex: from n/a through <= 1.3.2.

    gavias Winnex
  • Critical 9.8
    CVE-2025-39485

    WordPress GrandTour theme <= 5.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Grand Tour grandtour allows Object Injection.This issue affects Grand Tour: from n/a through <= 5.6.

    ThemeGoods Grand Tour
  • Critical 9.8
    CVE-2025-39480

    WordPress Car Dealer theme < 1.6.8 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer cardealer allows Object Injection.This issue affects Car Dealer: from n/a through < 1.6.8.

    ThemeMakers Car Dealer
  • High 8.1
    CVE-2025-39490

    WordPress Backpack Traveler theme <= 2.10.2 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows PHP Local File Inclusion.This issue affects Backpack Traveler: from n/a through <=…

    Mikado-Themes Backpack Traveler
  • High 8.1
    CVE-2025-39494

    WordPress Wilmër theme < 3.4.2 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wilmër wilmer allows PHP Local File Inclusion.This issue affects Wilmër: from n/a through < 3.4.2.

    Mikado-Themes Wilmër
  • Critical 9.8
    CVE-2025-39489

    WordPress CouponXL theme <= 4.5.0 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in pebas CouponXL couponxl allows Privilege Escalation.This issue affects CouponXL: from n/a through <= 4.5.0.

    pebas CouponXL
  • Critical 9.8
    CVE-2025-39499

    WordPress Medicare Theme <= 2.1.0 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in BoldThemes Medicare medicare allows Object Injection.This issue affects Medicare: from n/a through <= 2.1.0.

    Bold Themes Medicare
  • Critical 9.8
    CVE-2025-39495

    WordPress Avantage Theme <= 2.4.9 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in BoldThemes Avantage avantage allows Object Injection.This issue affects Avantage: from n/a through <= 2.4.9.

    Bold Themes Avantage
  • Critical 9.3
    CVE-2025-39501

    WordPress Goodlayers Hostel plugin <= 3.1.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Blind SQL Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.4.

    GoodLayers Goodlayers Hostel
  • Critical 9.8
    CVE-2025-39500

    WordPress Goodlayers Hostel Plugin <= 3.1.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Object Injection.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

    GoodLayers Goodlayers Hostel
  • High 7.1
    CVE-2025-39502

    WordPress Goodlayers Hostel Plugin <= 3.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hostel gdlr-hostel allows Reflected XSS.This issue affects Goodlayers Hostel: from n/a through <= 3.1.2.

    GoodLayers Goodlayers Hostel
  • Critical 9.8
    CVE-2025-39503

    WordPress Goodlayers Hotel plugin <= 3.1.4 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Object Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

    GoodLayers Goodlayers Hotel
  • Critical 9.3
    CVE-2025-39504

    WordPress Goodlayers Hotel plugin <= 3.1.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Blind SQL Injection.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

    GoodLayers Goodlayers Hotel
  • High 7.1
    CVE-2025-39505

    WordPress Goodlayers Hotel plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Goodlayers Hotel gdlr-hotel allows Reflected XSS.This issue affects Goodlayers Hotel: from n/a through <= 3.1.4.

    GoodLayers Goodlayers Hotel
  • High 8.2
    CVE-2025-39536

    WordPress JobHunt Job Alerts <= 3.6 - Arbitrary Content Deletion Vulnerability

    Missing Authorization vulnerability in Chimpstudio JobHunt Job Alerts allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobHunt Job Alerts: from n/a through 3.6.

    Chimpstudio JobHunt Job Alerts
  • High 8.1
    CVE-2025-39506

    WordPress Nasa Core Plugin <= 6.3.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Nasa Core nasa-core allows PHP Local File Inclusion.This issue affects Nasa Core: from n/a through <= 6.3.2.

    NasaTheme Nasa Core
  • High 7.1
    CVE-2025-46437

    WordPress Tayori Form plugin <= 1.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tayoricom Tayori Form tayori allows Reflected XSS.This issue affects Tayori Form: from n/a through <= 1.2.9.

    tayoricom Tayori Form
  • High 7.1
    CVE-2025-46440

    WordPress kStats Reloaded plugin <= 0.7.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark kStats Reloaded kstats-reloaded allows Reflected XSS.This issue affects kStats Reloaded: from n/a through <= 0.7.4.

    Mark kStats Reloaded
  • High 7.1
    CVE-2025-46446

    WordPress Libro de Reclamaciones plugin <= 1.0.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanrojas Libro de Reclamaciones libro-de-reclamaciones allows Stored XSS.This issue affects Libro de Reclamaciones: from n/a through <= 1.0.1.

    ivanrojas Libro de Reclamaciones
  • High 8.1
    CVE-2025-46444

    WordPress Ads Pro plugin <= 4.89 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in scripteo Ads Pro ap-plugin-scripteo allows PHP Local File Inclusion.This issue affects Ads Pro: from n/a through <= 4.89.

    scripteo Ads Pro
  • High 7.1
    CVE-2025-46448

    WordPress Document Management System plugin <= 1.24 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reifsnyderb Document Management System dms allows Reflected XSS.This issue affects Document Management System: from n/a through <= 1.24.

    reifsnyderb Document Management System
  • Critical 9.3
    CVE-2025-46455

    WordPress WP HRM LITE plugin <= 1.1 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in IndigoThemes WP HRM LITE wp-hrm-lite-human-resource-management-system allows SQL Injection.This issue affects WP HRM LITE: from n/a through <= 1.1.

    IndigoThemes WP HRM LITE
  • High 7.5
    CVE-2025-46454

    WordPress Meta Keywords & Description plugin <= 0.8 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in svil4ok Meta Keywords & Description wp-meta-keywords-meta-description allows PHP Local File Inclusion.This issue affects Meta Keywords & D…

    svil4ok Meta Keywords & Description
  • High 7.1
    CVE-2025-46456

    WordPress Theme Blvd Sliders plugin <= 1.2.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason Theme Blvd Sliders theme-blvd-sliders allows Reflected XSS.This issue affects Theme Blvd Sliders: from n/a through <= 1.2.5.

    Jason Theme Blvd Sliders Web / CMS
  • Critical 9.3
    CVE-2025-46460

    WordPress Easy Guide plugin <= 1.0.0 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Detheme Easy Guide wp-easy-guide allows SQL Injection.This issue affects Easy Guide: from n/a through <= 1.0.0.

    Detheme Easy Guide
  • High 8.2
    CVE-2025-46458

    WordPress occupancyplan plugin <= 1.0.3.0 - CSRF to SQL Injection vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in x000x occupancyplan occupancyplan allows SQL Injection.This issue affects occupancyplan: from n/a through <= 1.0.3.0.

    x000x occupancyplan
  • High 8.5
    CVE-2025-46463

    WordPress Mailing Group Listserv plugin <= 3.0.4 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Yamna Khawaja Mailing Group Listserv wp-mailing-group allows SQL Injection.This issue affects Mailing Group Listserv: from n/a through <= 3.0.4.

    Yamna Khawaja Mailing Group Listserv
  • Critical 9.8
    CVE-2025-46468

    WordPress Fable Extra plugin <= 1.0.6 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPFable Fable Extra fable-extra allows PHP Local File Inclusion.This issue affects Fable Extra: from n/a through <= 1.0.6.

    WPFable Fable Extra
  • High 8.1
    CVE-2025-46474

    WordPress SEUR Oficial plugin <= 2.2.23 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SEUR OFICIAL SEUR Oficial seur allows PHP Local File Inclusion.This issue affects SEUR Oficial: from n/a through <= 2.2.23.

    SEUR OFICIAL SEUR Oficial
  • Medium 4.9
    CVE-2025-46486

    WordPress Nomupay Payment Processing Gateway plugin <= 7.1.7 - Arbitrary File Download Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocessing-card-payments allows Path Traversal.This issue affects Nomupay Payment Processing Gateway: from …

    totalprocessing Nomupay Payment Processing Gateway
  • High 7.1
    CVE-2025-46487

    WordPress EC Authorize.net plugin <= 0.3.3 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sftranna EC Authorize.net ec-authorizenet allows Reflected XSS.This issue affects EC Authorize.net: from n/a through <= 0.3.3.

    sftranna EC Authorize.net
  • High 7.1
    CVE-2025-46488

    WordPress Visual Builder plugin <= 1.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in dastan800 Visual Builder visual-builder allows Reflected XSS.This issue affects Visual Builder: from n/a through <= 1.2.2.

    dastan800 Visual Builder
  • Medium 6.5
    CVE-2025-46493

    WordPress Crossword Compiler Puzzles plugin <= 14.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordwebsoftware Crossword Compiler Puzzles crossword-compiler-puzzles allows Stored XSS.This issue affects Crossword Compiler Puzzles: from n/a through <= 14…

    wordwebsoftware Crossword Compiler Puzzles