Skip to content
OpenAdvisories

Archive

June 2025

Vulnerabilities first published in this month (UTC), newest first.

← May 2025 2025 / June July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

1,610 results · Clear filters · Feed

  • Medium 5.9
    CVE-2025-53285

    WordPress Add & Replace Affiliate Links for Amazon plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Website Flip Add & Replace Affiliate Links for Amazon add-replace-affiliate-links-for-amazon allows Stored XSS.This issue affects Add & Replace Affiliate…

    The Website Flip Add & Replace Affiliate Links for Amazon
  • Medium 6.5
    CVE-2025-53284

    WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMS Blocks: from n/a through <= 1.1.

    pankaj.sakaria CMS Blocks
  • Medium 6.5
    CVE-2025-53282

    WordPress Thumbnail Editor plugin <= 2.3.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Thumbnail Editor thumbnail-editor allows Stored XSS.This issue affects Thumbnail Editor: from n/a through <= 2.3.3.

    aviplugins.com Thumbnail Editor
  • Medium 6.5
    CVE-2025-53280

    WordPress Football Pool plugin <= 2.12.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.5.

    antoineh Football Pool
  • Medium 6.5
    CVE-2025-53279

    WordPress Popup addon for Ninja Forms plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows DOM-Based XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.4.

    Aman Popup addon for Ninja Forms
  • Medium 6.5
    CVE-2025-53278

    WordPress WP AdCenter plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.0.

    WPeka WP AdCenter
  • Medium 6.5
    CVE-2025-53276

    WordPress Omnipress plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows DOM-Based XSS.This issue affects Omnipress: from n/a through <= 1.6.4.

    omnipressteam Omnipress
  • Medium 6.5
    CVE-2025-53275

    WordPress Leyka plugin <= 3.32.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows DOM-Based XSS.This issue affects Leyka: from n/a through <= 3.32.1.

    VaultDweller Leyka
  • Medium 4.3
    CVE-2025-53273

    WordPress Slickstream plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Slickstream Slickstream slick-engagement allows Cross Site Request Forgery.This issue affects Slickstream: from n/a through <= 2.0.3.

    Slickstream Slickstream
  • Medium 4.3
    CVE-2025-53272

    WordPress Image Cleanup plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in opicron Image Cleanup image-cleanup allows Cross Site Request Forgery.This issue affects Image Cleanup: from n/a through <= 1.9.2.

    opicron Image Cleanup
  • Medium 4.3
    CVE-2025-53269

    WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through <= 1.1.3.

    imw3 My Wp Brand
  • Medium 4.3
    CVE-2025-53270

    WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.

    Blend Media WordPress CTA Web / CMS
  • Medium 4.3
    CVE-2025-53268

    WordPress Import external attachments plugin <= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This issue affects Import external attachments: from n/a through <= 1.5.12.

    ryanpcmcquen Import external attachments
  • Medium 4.3
    CVE-2025-53267

    WordPress Hide Admin Bar From Front End plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Aftab Husain Hide Admin Bar From Front End hide-admin-bar-from-front-end allows Cross Site Request Forgery.This issue affects Hide Admin Bar From Front End: from n/a through <= 1.0.0.

    Aftab Husain Hide Admin Bar From Front End
  • Medium 4.3
    CVE-2025-53266

    WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through <= 1.3.0.

    EdwardBock Cron Logger
  • Medium 4.3
    CVE-2025-53264

    WordPress ONet Regenerate Thumbnails plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Konrád Koller ONet Regenerate Thumbnails onet-regenerate-thumbnails allows Cross Site Request Forgery.This issue affects ONet Regenerate Thumbnails: from n/a through <= 1.5.

    Konrád Koller ONet Regenerate Thumbnails
  • Medium 5.4
    CVE-2025-53265

    WordPress Virusdie plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Virusdie Virusdie virusdie allows Cross Site Request Forgery.This issue affects Virusdie: from n/a through <= 1.1.3.

    virusdie Virusdie
  • Medium 5.4
    CVE-2025-53263

    WordPress Address Autocomplete via Google for Gravity Forms plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a th…

    PluginsCafe Address Autocomplete via Google for Gravity Forms
  • Medium 4.3
    CVE-2025-53261

    WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through <= 1.10.0.

    macbookandrew WP YouTube Live
  • Medium 5.4
    CVE-2025-53262

    WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a through <= 1.0.5.

    Writesonic Writesonic
  • Medium 5.3
    CVE-2025-53255

    WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through <= 2.13.1.

    Nabil Lemsieh HurryTimer
  • Medium 5.9
    CVE-2025-53253

    WordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh WP Edit wp-edit allows Stored XSS.This issue affects WP Edit: from n/a through <= 4.0.4.

    Josh WP Edit
  • Medium 4.3
    CVE-2025-53254

    WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through <= 1.3.0.

    themeisle Cyrlitera
  • Medium 5.3
    CVE-2025-53211

    WordPress Audio Editor & Recorder plugin <= 2.2.3 - Sensitive Data Exposure Vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Retrieve Embedded Sensitive Data.This issue affects Audio Editor & Recorder: from n/a through <= …

    Roland Beaussant Audio Editor & Recorder
  • Medium 6.5
    CVE-2025-53206

    WordPress HT Mega – Absolute Addons for WPBakery Page Builder plugin <= 1.0.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder ht-mega-for-wpbakery allows Stored XSS.This issue affects HT Mega – Absolute Addons for WPBake…

    HT Plugins HT Mega – Absolute Addons for WPBakery Page Builder
  • Medium 4.3
    CVE-2025-53203

    WordPress WooCommerce PDF Invoice Builder plugin <= 1.2.148 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in EDGARROJAS WooCommerce PDF Invoice Builder woo-pdf-invoice-builder allows Cross Site Request Forgery.This issue affects WooCommerce PDF Invoice Builder: from n/a through <= 1.2.148.

    Edgar Rojas WooCommerce PDF Invoice Builder Web / CMS
  • Medium 6.5
    CVE-2025-53202

    WordPress Responsive Blocks plugin <= 2.0.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows DOM-Based XSS.This issue affects Responsive Blocks: from n/a through <= 2.0.6.

    cyberchimps Responsive Blocks
  • Medium 6.5
    CVE-2025-53199

    WordPress HT Slider For Elementor plugin <= 1.6.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Slider For Elementor ht-slider-for-elementor allows DOM-Based XSS.This issue affects HT Slider For Elementor: from n/a through <= 1.6.5.

    HT Plugins HT Slider For Elementor
  • Medium 4.3
    CVE-2025-53200

    WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through <= 6.7.3.

    Quantum Cloud ChatBot
  • Medium 4.3
    CVE-2025-53197

    WordPress Cookiebot plugin <= 4.5.8 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in cookiebot Cookiebot cookiebot allows Cross Site Request Forgery.This issue affects Cookiebot: from n/a through <= 4.5.8.

    cookiebot Cookiebot
  • Medium 4.3
    CVE-2025-53193

    WordPress Burst Statistics plugin <= 2.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Burst Statistics B.V. Burst Statistics burst-statistics allows Cross Site Request Forgery.This issue affects Burst Statistics: from n/a through <= 2.0.6.

    Burst Statistics Burst Statistics
  • Medium 6.3
    CVE-2025-6767

    sfturing hosp_order DoctorServiceImpl.java findDoctorByCondition sql injection

    A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been rated as critical. This issue affects the function findDoctorByCondition of the file DoctorServiceImpl.java. The manipulation of the argument hospital…

    sfturing hosp_order
  • Medium 6.3
    CVE-2025-6766

    sfturing hosp_order OfficeServiceImpl.java getOfficeName sql injection

    A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. It has been declared as critical. This vulnerability affects the function getOfficeName of the file OfficeServiceImpl.java. The manipulation of the argument offic…

    sfturing hosp_order
  • Medium 6.5
    CVE-2025-40910

    Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses

    Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can c…

  • Medium 6.3
    CVE-2025-6765

    Intelbras InControl HTTP PUT Request operador permission

    A vulnerability, which was classified as critical, has been found in Intelbras InControl 2.21.60.9. This issue affects some unknown processing of the file /v1/operador/ of the component HTTP PUT Request Handler. The manipulation leads to permission issues. Th…

    Intelbras InControl
  • Medium 4.3
    CVE-2025-32281

    WordPress DarkMySite plugin <= 1.2.8 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in DarkMySite DarkMySite darkmysite allows Cross Site Request Forgery.This issue affects DarkMySite: from n/a through <= 1.2.8.

    DarkMySite DarkMySite
  • Medium 6.3
    CVE-2025-6762

    diyhi bbs HTTP Header login getUrl server-side request forgery

    A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is pos…

    diyhi bbs
  • Medium 6.4
    CVE-2025-5398

    Ninja Forms <= 3.10.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via CSTI

    The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data…

    kstover Ninja Forms – The Contact Form Builder That Grows With You Web / CMS
  • Medium 4.3
    CVE-2025-5936

    VR Calendar <= 2.4.7 - Cross-Site Request Forgery to Calendar Sync

    The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.7. This is due to missing or incorrect nonce validation on the syncCalendar() function. This makes it possible for unauthenticated attac…

    Innate Images VR Calendar Web / CMS
  • Medium 6.4
    CVE-2025-6550

    The Pack Elementor addon <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The The Pack Elementor addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘slider_options’ parameter in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping. This makes it possible fo…

    webangon The Pack Elementor addon Web / CMS