Skip to content
OpenAdvisories

Archive

6 June 2025

Vulnerabilities first published on this day (UTC), newest first.

← May 2025 2025 / June /6 July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

208 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-49306

    WordPress WP Social Widget plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in catchsquare WP Social Widget wp-social-widget allows Stored XSS.This issue affects WP Social Widget: from n/a through <= 2.3.

    catchsquare WP Social Widget
  • Medium 6.5
    CVE-2025-49305

    WordPress Product Catalog Simple plugin <= 1.8.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode Product Catalog Simple post-type-x allows Stored XSS.This issue affects Product Catalog Simple: from n/a through <= 1.8.1.

    impleCode Product Catalog Simple
  • Medium 6.5
    CVE-2025-49304

    WordPress Search with Typesense plugin <= 2.0.10 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeManas Search with Typesense search-with-typesense allows Stored XSS.This issue affects Search with Typesense: from n/a through <= 2.0.10.

    CodeManas Search with Typesense
  • Medium 6.5
    CVE-2025-49301

    WordPress Greenshift plugin <= 11.5.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows DOM-Based XSS.This issue affects Greenshift: from n/a through <= 11.5.5.

    wpsoul Greenshift
  • Medium 6.5
    CVE-2025-49299

    WordPress WebHotelier plugin <= 1.9.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPlugged.com WebHotelier webhotelier allows Stored XSS.This issue affects WebHotelier: from n/a through <= 1.9.2.

    WPlugged.com WebHotelier
  • Medium 6.5
    CVE-2025-49298

    WordPress Event post plugin <= 5.10.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post allows Stored XSS.This issue affects Event post: from n/a through <= 5.10.1.

    Bastien Ho Event post
  • Medium 5.3
    CVE-2025-49294

    WordPress Crawlomatic Multisite Scraper Post Generator plugin <= 2.6.8.2 - Sensitive Data Exposure via Log Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Retrieve Embedded Sensitive Data.This issue affects Crawlomatic Multisite Scrape…

    CodeRevolution Crawlomatic Multisite Scraper Post Generator
  • Medium 4.3
    CVE-2025-49292

    WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability

    Improper Validation of Specified Quantity in Input vulnerability in Cozmoslabs Profile Builder profile-builder allows Phishing.This issue affects Profile Builder: from n/a through <= 3.13.8.

    Cozmoslabs Profile Builder
  • Medium 4.3
    CVE-2025-49293

    WordPress Crawlomatic Multisite Scraper Post Generator plugin <= 2.6.8.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CodeRevolution Crawlomatic Multisite Scraper Post Generator crawlomatic-multipage-scraper-post-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crawlomatic Multisite Sc…

    CodeRevolution Crawlomatic Multisite Scraper Post Generator
  • Medium 5.0
    CVE-2025-49289

    WordPress PDF for WPForms plugin <= 5.5.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.

    add-ons.org PDF for WPForms
  • Medium 4.3
    CVE-2025-49291

    WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.

    codepeople Calculated Fields Form
  • Medium 4.3
    CVE-2025-49287

    WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.

    WebToffee Product Feed for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-49285

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through …

    WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
  • Medium 4.3
    CVE-2025-49286

    WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.

    WP Table Builder WP Table Builder
  • Medium 4.3
    CVE-2025-49284

    WordPress WP Maintenance Mode & Site Under Construction plugin <= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a th…

    wp-buy WP Maintenance Mode & Site Under Construction
  • Medium 4.3
    CVE-2025-49283

    WordPress Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, …

    Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant
  • Medium 4.3
    CVE-2025-49273

    WordPress WP Tools plugin <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through <= 5.24.

    sminozzi WP Tools
  • Medium 4.3
    CVE-2025-49272

    WordPress Trinity Audio plugin <= 5.20.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.

    sergiotrinity Trinity Audio
  • Medium 4.3
    CVE-2025-49269

    WordPress Market Exporter plugin <= 2.0.22 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Anton Vanyukov Market Exporter market-exporter allows Cross Site Request Forgery.This issue affects Market Exporter: from n/a through <= 2.0.22.

    Anton Vanyukov Market Exporter
  • Medium 5.3
    CVE-2025-49268

    WordPress Verge3D plugin <= 4.9.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.

    Soft8Soft Verge3D
  • Medium 5.3
    CVE-2025-49270

    WordPress WP-CRM System plugin <= 3.4.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.

    Mario Peshev WP-CRM System
  • Medium 4.3
    CVE-2025-49248

    WordPress Team Showcase plugin < 25.05.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in cmoreira Team Showcase team-showcase-cm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Showcase: from n/a through < 25.05.13.

    cmoreira Team Showcase
  • Medium 4.3
    CVE-2025-49250

    WordPress Team Showcase plugin < 25.05.13 - Arbitrary Shortcode Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in cmoreira Team Showcase team-showcase-cm allows Code Injection.This issue affects Team Showcase: from n/a through < 25.05.13.

    cmoreira Team Showcase
  • Medium 4.3
    CVE-2025-49246

    WordPress Testimonials Showcase plugin <= 1.9.16 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.

    cmoreira Testimonials Showcase
  • Medium 6.5
    CVE-2025-49244

    WordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate shortcodes-ultimate allows Stored XSS.This issue affects Shortcodes Ultimate: from n/a through <= 7.3.5.

    Vova Shortcodes Ultimate
  • Medium 6.5
    CVE-2025-49243

    WordPress ShiftNav – Responsive Mobile Menu plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a…

    sevenspark ShiftNav – Responsive Mobile Menu
  • Medium 6.5
    CVE-2025-49242

    WordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through <= 1.4.3.

    sevenspark Bellows Accordion Menu
  • Medium 5.3
    CVE-2025-49241

    WordPress oik plugin <= 4.15.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in bobbingwide oik oik allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects oik: from n/a through <= 4.15.1.

    bobbingwide oik
  • Medium 4.3
    CVE-2025-49240

    WordPress DocsPress plugin <= 2.5.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.

    nK DocsPress
  • Medium 4.3
    CVE-2025-49238

    WordPress Everest Backup plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through <= 2.3.3.

    Everest themes Everest Backup
  • Medium 5.4
    CVE-2025-49239

    WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <…

    Tyche Softwares Print Invoice & Delivery Notes for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-49236

    WordPress Raychat plugin <= 2.1.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in raychat Raychat raychat allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Raychat: from n/a through <= 2.1.0.

    raychat Raychat
  • Medium 6.5
    CVE-2025-49235

    WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.6.0.

    rometheme RTMKit
  • Medium 4.7
    CVE-2025-5763

    Tenda CP3 apollo sub_F3C8C command injection

    A vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the file apollo. The manipulation leads to command injection. The attack can be launched remotely. The expl…

    Tenda CP3
  • Medium 6.3
    CVE-2025-5762

    code-projects Patient Record Management System view_hematology.php sql injection

    A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file view_hematology.php. The manipulation of the argument itr_no leads to sql injection. It is possible…

    code-projects Patient Record Management System
  • Medium 4.8
    CVE-2025-41367

    Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF

    Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requir…

    ZIV IDF and ZLF
  • Medium 5.1
    CVE-2025-41366

    CORS vulnerability in IDF and ZLF

    In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with …

    ZIV IDF and ZLF
  • Medium 5.1
    CVE-2025-41365

    Code injection vulnerability in IDF and ZLF

    Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the devic…

    ZIV IDF and ZLF
  • Medium 5.1
    CVE-2025-41364

    Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF

    Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requir…

    ZIV IDF and ZLF
  • Medium 5.3
    CVE-2025-41363

    CORS vulnerability in IDF and ZLF

    In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view …

    ZIV IDF and ZLF