Skip to content
OpenAdvisories

Archive

June 2025

Vulnerabilities first published in this month (UTC), newest first.

← May 2025 2025 / June July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

1,610 results · Clear filters · Feed

  • Medium 5.0
    CVE-2025-49289

    WordPress PDF for WPForms plugin <= 5.5.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PDF for WPForms: from n/a through <= 5.5.0.

    add-ons.org PDF for WPForms
  • Medium 4.3
    CVE-2025-49291

    WordPress Calculated Fields Form plugin <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in codepeople Calculated Fields Form calculated-fields-form allows Cross Site Request Forgery.This issue affects Calculated Fields Form: from n/a through <= 5.3.58.

    codepeople Calculated Fields Form
  • Medium 4.3
    CVE-2025-49287

    WordPress Product Feed for WooCommerce plugin <= 2.2.8 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WebToffee Product Feed for WooCommerce webtoffee-product-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Feed for WooCommerce: from n/a through <= 2.2.8.

    WebToffee Product Feed for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-49285

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 3.8.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Cross Site Request Forgery.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy Consent: from n/a through …

    WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
  • Medium 4.3
    CVE-2025-49286

    WordPress WP Table Builder plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Cross Site Request Forgery.This issue affects WP Table Builder: from n/a through <= 2.0.6.

    WP Table Builder WP Table Builder
  • Medium 4.3
    CVE-2025-49284

    WordPress WP Maintenance Mode & Site Under Construction plugin <= 4.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wp-buy WP Maintenance Mode & Site Under Construction wp-maintenance-mode-site-under-construction allows Cross Site Request Forgery.This issue affects WP Maintenance Mode & Site Under Construction: from n/a th…

    wp-buy WP Maintenance Mode & Site Under Construction
  • Medium 4.3
    CVE-2025-49283

    WordPress Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant plugin <= 4.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant gdpr-compliant-recaptcha-for-all-forms allows Cross Site Request Forgery.This issue affects Anti-spam, Spam protection, …

    Matthias Nordwig Anti-spam, Spam protection, ReCaptcha for all forms and GDPR-compliant
  • Medium 4.3
    CVE-2025-49273

    WordPress WP Tools plugin <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through <= 5.24.

    sminozzi WP Tools
  • Medium 4.3
    CVE-2025-49272

    WordPress Trinity Audio plugin <= 5.20.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.20.0.

    sergiotrinity Trinity Audio
  • Medium 4.3
    CVE-2025-49269

    WordPress Market Exporter plugin <= 2.0.22 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Anton Vanyukov Market Exporter market-exporter allows Cross Site Request Forgery.This issue affects Market Exporter: from n/a through <= 2.0.22.

    Anton Vanyukov Market Exporter
  • Medium 5.3
    CVE-2025-49268

    WordPress Verge3D plugin <= 4.9.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Soft8Soft LLC Verge3D verge3d allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Verge3D: from n/a through <= 4.9.4.

    Soft8Soft Verge3D
  • Medium 5.3
    CVE-2025-49270

    WordPress WP-CRM System plugin <= 3.4.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP-CRM System: from n/a through <= 3.4.2.

    Mario Peshev WP-CRM System
  • Medium 4.3
    CVE-2025-49248

    WordPress Team Showcase plugin < 25.05.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in cmoreira Team Showcase team-showcase-cm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Team Showcase: from n/a through < 25.05.13.

    cmoreira Team Showcase
  • Medium 4.3
    CVE-2025-49250

    WordPress Team Showcase plugin < 25.05.13 - Arbitrary Shortcode Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in cmoreira Team Showcase team-showcase-cm allows Code Injection.This issue affects Team Showcase: from n/a through < 25.05.13.

    cmoreira Team Showcase
  • Medium 4.3
    CVE-2025-49246

    WordPress Testimonials Showcase plugin <= 1.9.16 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in cmoreira Testimonials Showcase testimonials-showcase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Testimonials Showcase: from n/a through <= 1.9.16.

    cmoreira Testimonials Showcase
  • Medium 6.5
    CVE-2025-49244

    WordPress Shortcodes Ultimate plugin <= 7.3.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vova Shortcodes Ultimate shortcodes-ultimate allows Stored XSS.This issue affects Shortcodes Ultimate: from n/a through <= 7.3.5.

    Vova Shortcodes Ultimate
  • Medium 6.5
    CVE-2025-49243

    WordPress ShiftNav – Responsive Mobile Menu plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark ShiftNav – Responsive Mobile Menu shiftnav-responsive-mobile-menu allows Stored XSS.This issue affects ShiftNav – Responsive Mobile Menu: from n/a…

    sevenspark ShiftNav – Responsive Mobile Menu
  • Medium 6.5
    CVE-2025-49242

    WordPress Bellows Accordion Menu plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sevenspark Bellows Accordion Menu bellows-accordion-menu allows Stored XSS.This issue affects Bellows Accordion Menu: from n/a through <= 1.4.3.

    sevenspark Bellows Accordion Menu
  • Medium 5.3
    CVE-2025-49241

    WordPress oik plugin <= 4.15.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in bobbingwide oik oik allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects oik: from n/a through <= 4.15.1.

    bobbingwide oik
  • Medium 4.3
    CVE-2025-49240

    WordPress DocsPress plugin <= 2.5.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in nK DocsPress docspress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DocsPress: from n/a through <= 2.5.2.

    nK DocsPress
  • Medium 4.3
    CVE-2025-49238

    WordPress Everest Backup plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Cross Site Request Forgery.This issue affects Everest Backup: from n/a through <= 2.3.3.

    Everest themes Everest Backup
  • Medium 5.4
    CVE-2025-49239

    WordPress Print Invoice & Delivery Notes for WooCommerce plugin <= 5.5.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Cross Site Request Forgery.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <…

    Tyche Softwares Print Invoice & Delivery Notes for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-49236

    WordPress Raychat plugin <= 2.1.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in raychat Raychat raychat allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Raychat: from n/a through <= 2.1.0.

    raychat Raychat
  • Medium 6.5
    CVE-2025-49235

    WordPress RTMKit Addons for Elementor plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor allows Stored XSS.This issue affects RTMKit: from n/a through <= 1.6.0.

    rometheme RTMKit
  • Medium 4.7
    CVE-2025-5763

    Tenda CP3 apollo sub_F3C8C command injection

    A vulnerability has been found in Tenda CP3 11.10.00.2311090948 and classified as critical. Affected by this vulnerability is the function sub_F3C8C of the file apollo. The manipulation leads to command injection. The attack can be launched remotely. The expl…

    Tenda CP3
  • Medium 6.3
    CVE-2025-5762

    code-projects Patient Record Management System view_hematology.php sql injection

    A vulnerability, which was classified as critical, was found in code-projects Patient Record Management System 1.0. Affected is an unknown function of the file view_hematology.php. The manipulation of the argument itr_no leads to sql injection. It is possible…

    code-projects Patient Record Management System
  • Medium 4.8
    CVE-2025-41367

    Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF

    Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requir…

    ZIV IDF and ZLF
  • Medium 5.1
    CVE-2025-41366

    CORS vulnerability in IDF and ZLF

    In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can only be executed with …

    ZIV IDF and ZLF
  • Medium 5.1
    CVE-2025-41365

    Code injection vulnerability in IDF and ZLF

    Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the devic…

    ZIV IDF and ZLF
  • Medium 5.1
    CVE-2025-41364

    Stored Cross-Site Scripting (XSS) vulnerability in IDF and ZLF

    Stored Cross-Site Scripting (XSS) vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious JavaScript payload in software that will run in the victim's browser. Exploiting this vulnerability requir…

    ZIV IDF and ZLF
  • Medium 5.3
    CVE-2025-41363

    CORS vulnerability in IDF and ZLF

    In IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04, a configuration error has been detected in cross-origin resource sharing (CORS). Exploiting this vulnerability requires authenticating to the device and executing certain commands that can be executed with view …

    ZIV IDF and ZLF
  • Medium 5.3
    CVE-2025-41362

    Code injection vulnerability in IDF and ZLF

    Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the devic…

    ZIV IDF and ZLF
  • Medium 5.4
    CVE-2025-48335

    WordPress Responsive Plus plugin <= 3.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CyberChimps Responsive Plus responsive-add-ons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Responsive Plus: from n/a through <= 3.2.0.

    cyberchimps Responsive Plus
  • Medium 4.3
    CVE-2025-48328

    WordPress Real Time Validation for Gravity Forms plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Daman Jeet Real Time Validation for Gravity Forms real-time-validation-for-gravity-forms allows Cross Site Request Forgery.This issue affects Real Time Validation for Gravity Forms: from n/a through <= 1.7.0.

    Daman Jeet Real Time Validation for Gravity Forms
  • Medium 6.5
    CVE-2025-49076

    WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Stored XSS.This issue affects The Plus Addons for …

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 6.5
    CVE-2025-49075

    WordPress Wishlist plugin <= 1.0.43 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Wishlist wishlist allows Stored XSS.This issue affects Wishlist: from n/a through <= 1.0.43.

    PickPlugins Wishlist
  • Medium 6.5
    CVE-2025-49074

    WordPress WidgetKit plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Abu Huraira Bin Aman WidgetKit widgetkit-for-elementor allows Stored XSS.This issue affects WidgetKit: from n/a through <= 2.5.4.

    Abu Huraira Bin Aman WidgetKit
  • Medium 6.5
    CVE-2025-49068

    WordPress Ocean Extra plugin <= 2.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oceanwp Ocean Extra ocean-extra allows Stored XSS.This issue affects Ocean Extra: from n/a through <= 2.4.8.

    OceanWP Ocean Extra
  • Medium 6.5
    CVE-2025-49067

    WordPress Nasa Core plugin < 6.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NasaTheme Nasa Core nasa-core allows Stored XSS.This issue affects Nasa Core: from n/a through < 6.4.1.

    NasaTheme Nasa Core
  • Medium 6.3
    CVE-2025-5761

    PHPGurukul BP Monitoring Management System edit-family-member.php sql injection

    A vulnerability, which was classified as critical, has been found in PHPGurukul BP Monitoring Management System 1.0. This issue affects some unknown processing of the file /edit-family-member.php. The manipulation of the argument memberage leads to sql inject…

    PHPGurukul BP Monitoring Management System