Skip to content
OpenAdvisories

Archive

6 June 2025

Vulnerabilities first published on this day (UTC), newest first.

← May 2025 2025 / June /6 July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

208 results · Clear filters · Feed

  • Medium 5.9
    CVE-2025-30941

    WordPress Pinterest Verify Meta Tag plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marvie Pons Pinterest Verify Meta Tag pinterest-verify-meta-tag allows Stored XSS.This issue affects Pinterest Verify Meta Tag: from n/a through <= 1.3.

    Marvie Pons Pinterest Verify Meta Tag
  • Medium 5.9
    CVE-2025-30942

    WordPress Post Custom Templates Lite plugin <= 1.14 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through <= 1.14.

    otwthemes Post Custom Templates Lite
  • Medium 4.3
    CVE-2025-30946

    WordPress Custom Bulk/Quick Edit plugin <= 1.6.10 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Michael Cannon Custom Bulk/Quick Edit custom-bulkquick-edit allows Cross Site Request Forgery.This issue affects Custom Bulk/Quick Edit: from n/a through <= 1.6.10.

    Michael Cannon Custom Bulk/Quick Edit
  • Medium 5.3
    CVE-2025-30945

    WordPress Taskbuilder plugin <= 4.0.7 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in taskbuilder Taskbuilder taskbuilder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Taskbuilder: from n/a through <= 4.0.7.

    Taskbuilder Taskbuilder
  • Medium 4.3
    CVE-2025-30948

    WordPress Layouts for Elementor plugin <= 1.11 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Giraphix Creative Layouts for Elementor layouts-for-elementor allows Cross Site Request Forgery.This issue affects Layouts for Elementor: from n/a through <= 1.11.

    Giraphix Creative Layouts for Elementor
  • Medium 6.5
    CVE-2025-30950

    WordPress All Currencies for WooCommerce plugin <= 2.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham All Currencies for WooCommerce woocommerce-all-currencies allows Stored XSS.This issue affects All Currencies for WooCommerce: from n/a through <= 2.…

    WP Wham All Currencies for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-30952

    WordPress Nexa Blocks plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This issue affects Nexa Blocks: from n/a through <= 1.1.0.

    wpdive Nexa Blocks
  • Medium 6.5
    CVE-2025-30951

    WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.36 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Stored XSS.This issue affects BlockStrap Page Builder - Bootstrap Bl…

    Stiofan BlockStrap Page Builder - Bootstrap Blocks
  • Medium 4.7
    CVE-2025-30953

    WordPress WP Gravity Forms Salesforce plugin <= 1.4.7 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Salesforce gf-salesforce-crmperks allows Phishing.This issue affects WP Gravity Forms Salesforce: from n/a through <= 1.4.7.

    CRM Perks WP Gravity Forms Salesforce
  • Medium 4.7
    CVE-2025-30954

    WordPress WP Gravity Forms Constant Contact Plugin <= 1.1.0 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms Constant Contact Plugin gf-constant-contact allows Phishing.This issue affects WP Gravity Forms Constant Contact Plugin: from n/a through <= 1.1.0.

    CRM Perks WP Gravity Forms Constant Contact Plugin
  • Medium 5.4
    CVE-2025-30957

    WordPress Activity Plus Reloaded for BuddyPress plugin <= 1.1.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in BuddyDev Activity Plus Reloaded for BuddyPress bp-activity-plus-reloaded allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Activity Plus Reloaded for BuddyPress: from n/a through …

    BuddyDev Activity Plus Reloaded for BuddyPress
  • Medium 4.3
    CVE-2025-30956

    WordPress Booqable Rental plugin <= 2.4.25 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Booqable Rental Software Booqable Rental booqable-rental-reservations allows Cross Site Request Forgery.This issue affects Booqable Rental: from n/a through <= 2.4.25.

    Booqable Rental Software Booqable Rental
  • Medium 5.4
    CVE-2025-30958

    WordPress onOffice for WP-Websites plugin <= 6.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in onOffice GmbH onOffice for WP-Websites onoffice-for-wp-websites allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onOffice for WP-Websites: from n/a through <= 6.5.1.

    onOffice onOffice for WP-Websites
  • Medium 5.4
    CVE-2025-30968

    WordPress Advanced Post List plugin <= 0.5.6.2 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in jokerbr313 Advanced Post List advanced-post-list allows Cross Site Request Forgery.This issue affects Advanced Post List: from n/a through <= 0.5.6.2.

    jokerbr313 Advanced Post List
  • Medium 4.3
    CVE-2025-30974

    WordPress Post Grid Master plugin <= 3.4.17 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Akhtarujjaman Shuvo Post Grid Master ajax-filter-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post Grid Master: from n/a through <= 3.4.17.

    Akhtarujjaman Shuvo Post Grid Master
  • Medium 4.9
    CVE-2025-30976

    WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a through <= 1.1.1.

    wpdive Nexa Blocks
  • Medium 4.3
    CVE-2025-30978

    WordPress Slack Notifications by dorzki plugin <= 2.0.7 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Dor Zuberi Slack Notifications by dorzki dorzki-notifications-to-slack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slack Notifications by dorzki: from n/a through <= 2.0.7.

    Dor Zuberi Slack Notifications by dorzki
  • Medium 5.9
    CVE-2025-30977

    WordPress Chaport <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This issue affects Chaport: from n/a through <= 1.1.6.

    Chaport Live Chat Chaport
  • Medium 6.3
    CVE-2025-30981

    WordPress WP-Recall plugin <= 16.26.14 - CSRF to Privilege Escalation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in tggfref WP-Recall allows Privilege Escalation. This issue affects WP-Recall: from n/a through 16.26.14.

    tggfref WP-Recall
  • Medium 4.3
    CVE-2025-30980

    WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.

    Alessandro Piconi Simple Keyword to Link
  • Medium 5.4
    CVE-2025-30986

    WordPress Elite Video Player plugin <= 10.0.5 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Cross Site Request Forgery.This issue affects Elite Video Player: from n/a through <= 10.0.5.

    _CreativeMedia_ Elite Video Player
  • Medium 6.5
    CVE-2025-30991

    WordPress Premium Packages plugin <= 6.0.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Stored XSS.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.6.

    Shahjada WPDM – Premium Packages
  • Medium 4.3
    CVE-2025-30990

    WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through <= 1.2.0.

    ThemeHunk ThemeHunk
  • Medium 4.3
    CVE-2025-30994

    WordPress CubeWP plugin <= 1.1.29 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Cross Site Request Forgery.This issue affects CubeWP: from n/a through <= 1.1.29.

    Imran Tauqeer CubeWP
  • Medium 5.4
    CVE-2025-30997

    WordPress Car Repair Services theme <= 5.0 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Car Repair Services car-repair-services allows Server Side Request Forgery.This issue affects Car Repair Services: from n/a through <= 5.0.

    SmartDataSoft Car Repair Services
  • Medium 5.3
    CVE-2025-31000

    WordPress Payment QR WooCommerce plugin <= 1.1.6 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Miguel Fuentes Payment QR WooCommerce payment-qr-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment QR WooCommerce: from n/a through <= 1.1.6.

    Miguel Fuentes Payment QR WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-31025

    WordPress Image Hover Effects Block plugin <= 1.4.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blocksera Image Hover Effects Block image-hover-effects-block allows Stored XSS.This issue affects Image Hover Effects Block: from n/a through <= 1.4.5.

    Blocksera Image Hover Effects Block
  • Medium 5.9
    CVE-2025-49333

    WordPress Simple Membership plugin <= 4.6.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership simple-membership allows Stored XSS.This issue affects Simple Membership: from n/a through <= 4.6.3.

    wp.insider Simple Membership
  • Medium 6.6
    CVE-2025-49329

    WordPress Store Locator WordPress plugin <= 1.5.2 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Server.This issue affects Store Locator WordPress: from n/a through <= 1.5.2.

    Agile Logix Store Locator WordPress Web / CMS
  • Medium 4.3
    CVE-2025-49332

    WordPress WP Time Slots Booking Form plugin <= 1.2.30 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.30.

    codepeople WP Time Slots Booking Form
  • Medium 4.7
    CVE-2025-49325

    WordPress Newspack Newsletters plugin <= 3.13.0 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Automattic Newspack Newsletters newspack-newsletters allows Phishing.This issue affects Newspack Newsletters: from n/a through <= 3.13.0.

    Automattic Newspack Newsletters
  • Medium 5.3
    CVE-2025-49324

    WordPress Job Board Manager plugin <= 2.1.60 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Job Board Manager: from n/a through <= 2.1.60.

    PickPlugins Job Board Manager
  • Medium 5.9
    CVE-2025-49322

    WordPress 404 Page by SeedProd < 1.0.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SeedProd 404 Page by SeedProd allows Stored XSS. This issue affects 404 Page by SeedProd: from n/a through n/a.

    SeedProd 404 Page by SeedProd
  • Medium 5.9
    CVE-2025-49318

    WordPress WPtouch plugin <= 4.3.60 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPtouch WPtouch wptouch allows Stored XSS.This issue affects WPtouch: from n/a through <= 4.3.60.

    WPtouch WPtouch
  • Medium 5.3
    CVE-2025-49320

    WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in fraudlabspro FraudLabs Pro for WooCommerce fraudlabs-pro-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FraudLabs Pro for WooCommerce: from n/a through <= 2.22.…

    FraudLabs Pro FraudLabs Pro for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-49317

    WordPress WP Page Loading plugin <= 1.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in NTC WP Page Loading wp-page-loading allows Cross Site Request Forgery.This issue affects WP Page Loading: from n/a through <= 1.0.6.

    NTC WP Page Loading
  • Medium 6.5
    CVE-2025-49311

    WordPress The Events Calendar Countdown Addon plugin <= 1.4.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CoolHappy The Events Calendar Countdown Addon countdown-for-the-events-calendar allows Stored XSS.This issue affects The Events Calendar Countdown Addon: fro…

    CoolHappy The Events Calendar Countdown Addon
  • Medium 6.5
    CVE-2025-49314

    WordPress BRW plugin <= 1.8.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ovatheme BRW ova-brw allows Stored XSS.This issue affects BRW: from n/a through <= 1.8.6.

    Ovatheme BRW
  • Medium 6.5
    CVE-2025-49309

    WordPress HT Team Member plugin <= 1.1.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Team Member ht-team-member allows Stored XSS.This issue affects HT Team Member: from n/a through <= 1.1.7.

    HT Plugins HT Team Member
  • Medium 6.5
    CVE-2025-49310

    WordPress Frontend Dashboard plugin <= 2.2.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in M A Vinoth Kumar Frontend Dashboard frontend-dashboard allows Stored XSS.This issue affects Frontend Dashboard: from n/a through <= 2.2.8.

    M A Vinoth Kumar Frontend Dashboard