Skip to content
OpenAdvisories

Archive

9 June 2025

Vulnerabilities first published on this day (UTC), newest first.

← May 2025 2025 / June /9 July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

181 results · Feed

  • High 7.1
    CVE-2025-47477

    WordPress Backup and Staging by WP Time Capsule plugin <= 1.22.23 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx Backup and Staging by WP Time Capsule wp-time-capsule allows Reflected XSS.This issue affects Backup and Staging by WP Time Capsule: from n/a through…

    revmakx Backup and Staging by WP Time Capsule
  • High 7.1
    CVE-2025-47463

    WordPress Stock Locations for WooCommerce plugin <= 2.8.6 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stock Locations for WooCommerce: from n/a through <…

    Fahad Mahmood Stock Locations for WooCommerce Web / CMS
  • High 7.1
    CVE-2025-47487

    WordPress MC Woocommerce Wishlist plugin <= 1.9.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Moreconvert Team MC Woocommerce Wishlist smart-wishlist-for-more-convert allows Reflected XSS.This issue affects MC Woocommerce Wishlist: from n/a through <=…

    Moreconvert Team MC Woocommerce Wishlist Web / CMS
  • Medium 6.8
    CVE-2025-47511

    WordPress Welcart e-Commerce plugin <= 2.11.13 - Arbitrary File Deletion Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Path Traversal.This issue affects Welcart e-Commerce: from n/a through <= 2.11.13.

    info@welcart Welcart e-Commerce
  • High 8.8
    CVE-2025-47561

    WordPress MapSVG plugin < 8.6.13 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in RomanCode MapSVG mapsvg allows Privilege Escalation.This issue affects MapSVG: from n/a through < 8.6.13.

    RomanCode MapSVG
  • High 7.1
    CVE-2025-47527

    WordPress Icegram Collect – Easy Form, Lead Collection and Subscription plugin <= 1.3.18 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Icegram Icegram Collect icegram-rainmaker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram Collect: from n/a through <= 1.3.18.

    Icegram Icegram Collect
  • Medium 6.5
    CVE-2025-47598

    WordPress History Log by click5 plugin <= 1.0.13 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in click5 History Log by click5 history-log-by-click5 allows Stored XSS.This issue affects History Log by click5: from n/a through <= 1.0.13.

    click5 History Log by click5
  • Critical 9.3
    CVE-2025-47608 Public exploit

    WordPress Recover abandoned cart for WooCommerce plugin <= 2.5 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sonalsinha21 Recover abandoned cart for WooCommerce recover-wc-abandoned-cart allows SQL Injection.This issue affects Recover abandoned cart for WooCommerce:…

    sonalsinha21 Recover abandoned cart for WooCommerce Web / CMS
  • High 8.5
    CVE-2025-47651

    WordPress Infility Global plugin <= 2.15.06 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injection.This issue affects Infility Global: from n/a through <= 2.15.06.

    infility Infility Global
  • Critical 9.3
    CVE-2025-48122

    WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows…

    Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Web / CMS
  • High 7.5
    CVE-2025-48124

    WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Arbitrary File Download Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Path …

    Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Web / CMS
  • Critical 10.0
    CVE-2025-48123

    WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Remote Code Execution (RCE) Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Code Injection.This issue …

    Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Web / CMS
  • High 8.1
    CVE-2025-48125

    WordPress WP Event Manager plugin <= 3.1.51 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Event Manager WP Event Manager wp-event-manager allows PHP Local File Inclusion.This issue affects WP Event Manager: from n/a through <…

    WP Event Manager WP Event Manager
  • High 8.1
    CVE-2025-48126

    WordPress Essential Real Estate plugin <= 5.2.9 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate essential-real-estate allows PHP Local File Inclusion.This issue affects Essential Real Estate: from n/a thr…

    G5Theme Essential Real Estate
  • Critical 9.8
    CVE-2025-48129 Public exploit

    WordPress Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light plugin <= 2.4.37 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light excel-like-price-change-for-woocommerce-and-wp-e-commerce-light allows Privilege Escalation.This issue affects Spreadsheet P…

    Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light Web / CMS
  • High 7.5
    CVE-2025-48130

    WordPress Spice Blocks plugin <= 2.0.7.4 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spicethemes Spice Blocks spice-blocks allows Path Traversal.This issue affects Spice Blocks: from n/a through <= 2.0.7.4.

    spicethemes Spice Blocks
  • Medium 6.5
    CVE-2025-48139

    WordPress StyleAI plugin <= 1.0.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in relentlo StyleAI relentlosoftware allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects StyleAI: from n/a through <= 1.0.4.

    relentlo StyleAI
  • Critical 9.9
    CVE-2025-48140

    WordPress MetalpriceAPI plugin <= 1.1.4 - Remote Code Execution (RCE) Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in metalpriceapi MetalpriceAPI metalpriceapi allows Code Injection.This issue affects MetalpriceAPI: from n/a through <= 1.1.4.

    metalpriceapi MetalpriceAPI
  • Critical 9.3
    CVE-2025-48141

    WordPress Multi CryptoCurrency Payments plugin <= 2.0.7 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alex Zaytseff Multi CryptoCurrency Payments multi-crypto-currency-payment allows SQL Injection.This issue affects Multi CryptoCurrency Payments: from n/a thr…

    Alex Zaytseff Multi CryptoCurrency Payments
  • High 7.1
    CVE-2025-48143

    WordPress Formulario de contacto SalesUp! plugin <= 1.0.14 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salesup2019 Formulario de contacto SalesUp! formularios-de-contacto-salesup allows Reflected XSS.This issue affects Formulario de contacto SalesUp!: from n/a…

    salesup2019 Formulario de contacto SalesUp!
  • Medium 6.5
    CVE-2025-48147

    WordPress CryptoCloud - Crypto Payment Gateway plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crypto Cloud CryptoCloud - Crypto Payment Gateway cryptocloud-crypto-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CryptoCloud - Crypto Payment Gateway: from n…

    Crypto Cloud CryptoCloud - Crypto Payment Gateway
  • High 7.5
    CVE-2025-48261

    WordPress MultiVendorX plugin <= 4.2.22 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Retrieve Embedded Sensitive Data.This issue affects MultiVendorX: from n/a through <= 4.2.22.

    MultiVendorX MultiVendorX
  • High 8.6
    CVE-2025-48267

    WordPress WP Pipes plugin <= 1.4.2 - Arbitrary File Deletion Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ThimPress WP Pipes allows Path Traversal. This issue affects WP Pipes: from n/a through 1.4.2.

    ThimPress WP Pipes
  • High 7.1
    CVE-2025-48279

    WordPress WC MyParcel Belgium plugin <= 4.5.5-beta - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Richard Perdaan WC MyParcel Belgium allows Reflected XSS. This issue affects WC MyParcel Belgium: from 4.5.5 through beta.

    Richard Perdaan WC MyParcel Belgium
  • Critical 9.3
    CVE-2025-48281 Scanner template

    WordPress MyStyle Custom Product Designer plugin <= 3.21.1 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in mystyleplatform MyStyle Custom Product Designer mystyle-custom-product-designer allows Blind SQL Injection.This issue affects MyStyle Custom Product Designer…

    mystyleplatform MyStyle Custom Product Designer
  • High 7.5
    CVE-2025-49265

    WordPress Membership For WooCommerce plugin <= 2.8.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WP Swings Membership For WooCommerce membership-for-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Membership For WooCommerce: from n/a through <= 2.8.1.

    WP Swings Membership For WooCommerce Web / CMS
  • High 8.1
    CVE-2025-49275

    WordPress Blogbyte theme <= 1.1.1 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogbyte blogbyte allows PHP Local File Inclusion.This issue affects Blogbyte: from n/a through <= 1.1.1.

    unfoldwp Blogbyte
  • High 8.1
    CVE-2025-49276

    WordPress Blogmine theme <= 1.1.7 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogmine blogmine allows PHP Local File Inclusion.This issue affects Blogmine: from n/a through <= 1.1.7.

    unfoldwp Blogmine
  • High 8.1
    CVE-2025-49278

    WordPress Blogty theme <= 1.0.11 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogty blogty allows PHP Local File Inclusion.This issue affects Blogty: from n/a through <= 1.0.11.

    unfoldwp Blogty
  • High 8.1
    CVE-2025-49277

    WordPress Blogprise theme <= 1.0.9 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogprise blogprise allows PHP Local File Inclusion.This issue affects Blogprise: from n/a through <= 1.0.9.

    unfoldwp Blogprise
  • High 8.1
    CVE-2025-49279

    WordPress Blogvy theme <= 1.0.7 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Blogvy blogvy allows PHP Local File Inclusion.This issue affects Blogvy: from n/a through <= 1.0.7.

    unfoldwp Blogvy
  • High 8.1
    CVE-2025-49280

    WordPress Magty theme <= 1.0.6 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magty magty allows PHP Local File Inclusion.This issue affects Magty: from n/a through <= 1.0.6.

    unfoldwp Magty
  • High 8.1
    CVE-2025-49281

    WordPress Magways theme <= 1.2.1 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magways magways allows PHP Local File Inclusion.This issue affects Magways: from n/a through <= 1.2.1.

    unfoldwp Magways
  • High 8.1
    CVE-2025-49282

    WordPress Magze theme <= 1.0.9 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in unfoldwp Magze magze allows PHP Local File Inclusion.This issue affects Magze: from n/a through <= 1.0.9.

    unfoldwp Magze
  • High 8.1
    CVE-2025-49295

    WordPress MediClinic theme <= 2.1 - Local File Inclusion Vulnerability

    Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1.

    Mikado-Themes MediClinic
  • High 8.1
    CVE-2025-49296

    WordPress GrandPrix theme <= 1.6 - Local File Inclusion Vulnerability

    Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6.

    Mikado-Themes GrandPrix
  • High 8.1
    CVE-2025-49297

    WordPress Grill and Chow theme <= 1.6 - Local File Inclusion Vulnerability

    Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6.

    Mikado-Themes Grill and Chow
  • Medium 4.3
    CVE-2025-5885

    Konica Minolta bizhub cross-site request forgery

    A vulnerability has been found in Konica Minolta bizhub up to 20250202 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been dis…

    Konica Minolta bizhub
  • Low 3.5
    CVE-2025-5884

    Konica Minolta bizhub Display MFP Information List cross site scripting

    A vulnerability, which was classified as problematic, was found in Konica Minolta bizhub up to 20250202. This affects an unknown part of the component Display MFP Information List. The manipulation of the argument Model Name leads to cross site scripting. It …

    Konica Minolta bizhub
  • Medium 6.3
    CVE-2025-5881

    code-projects Chat System confirm_password.php sql injection

    A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirm_password.php. The manipulation of the argument cid leads to sql injection. The attack may be init…

    code-projects Chat System