Skip to content
OpenAdvisories

Archive

June 2025

Vulnerabilities first published in this month (UTC), newest first.

← May 2025 2025 / June July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

3,706 results · Feed

  • Medium 5.3
    CVE-2025-53295

    WordPress iCount Payment Gateway plugin <= 2.0.7 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in iCount iCount Payment Gateway icount allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects iCount Payment Gateway: from n/a through <= 2.0.7.

    icount iCount Payment Gateway
  • Medium 5.9
    CVE-2025-53296

    WordPress EC Stars Rating plugin <= 1.0.11 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ecoal95 EC Stars Rating ec-stars-rating allows Stored XSS.This issue affects EC Stars Rating: from n/a through <= 1.0.11.

    ecoal95 EC Stars Rating
  • Medium 6.5
    CVE-2025-53294

    WordPress Smart Agenda plugin <= 4.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Smart Agenda Smart Agenda smart-agenda-prise-de-rendez-vous-en-ligne allows Stored XSS.This issue affects Smart Agenda: from n/a through <= 4.9.

    Smart Agenda Smart Agenda
  • Medium 6.5
    CVE-2025-53292

    WordPress WP DataTable plugin <= 0.2.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in samsk WP DataTable wp-datatable allows DOM-Based XSS.This issue affects WP DataTable: from n/a through <= 0.2.7.

    samsk WP DataTable
  • Medium 4.3
    CVE-2025-53293

    WordPress Dashboard Widget Sidebar plugin <= 1.2.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Morten Dalgaard Johansen Dashboard Widget Sidebar dashboard-widget-sidebar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Dashboard Widget Sidebar: from n/a through <= 1.2.3.

    Morten Dalgaard Johansen Dashboard Widget Sidebar
  • Medium 6.5
    CVE-2025-53290

    WordPress WP Visual Sitemap plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MS WP Visual Sitemap wp-visual-sitemap allows Stored XSS.This issue affects WP Visual Sitemap: from n/a through <= 1.0.2.

    MS WP Visual Sitemap
  • Medium 5.9
    CVE-2025-53287

    WordPress Quick Favicon plugin <= 0.22.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robert Cummings Quick Favicon quick-favicon allows Stored XSS.This issue affects Quick Favicon: from n/a through <= 0.22.8.

    Robert Cummings Quick Favicon
  • Medium 4.3
    CVE-2025-53288

    WordPress PlatiOnline Payments plugin <= 7.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Adrian Ladó PlatiOnline Payments plationline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlatiOnline Payments: from n/a through <= 7.0.0.

    Adrian Ladó PlatiOnline Payments
  • Medium 5.9
    CVE-2025-53285

    WordPress Add & Replace Affiliate Links for Amazon plugin <= 1.0.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Website Flip Add & Replace Affiliate Links for Amazon add-replace-affiliate-links-for-amazon allows Stored XSS.This issue affects Add & Replace Affiliate…

    The Website Flip Add & Replace Affiliate Links for Amazon
  • Medium 6.5
    CVE-2025-53284

    WordPress CMS Blocks plugin <= 1.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in pankaj.sakaria CMS Blocks cms-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CMS Blocks: from n/a through <= 1.1.

    pankaj.sakaria CMS Blocks
  • Medium 6.5
    CVE-2025-53282

    WordPress Thumbnail Editor plugin <= 2.3.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Thumbnail Editor thumbnail-editor allows Stored XSS.This issue affects Thumbnail Editor: from n/a through <= 2.3.3.

    aviplugins.com Thumbnail Editor
  • High 7.5
    CVE-2025-53281

    WordPress WPB Category Slider for WooCommerce plugin <= 1.71 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WPBean WPB Category Slider for WooCommerce wpb-woocommerce-category-slider allows PHP Local File Inclusion.This issue affects WPB Category…

    wpbean WPB Category Slider for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-53280

    WordPress Football Pool plugin <= 2.12.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AntoineH Football Pool football-pool allows Stored XSS.This issue affects Football Pool: from n/a through <= 2.12.5.

    antoineh Football Pool
  • Medium 6.5
    CVE-2025-53279

    WordPress Popup addon for Ninja Forms plugin <= 3.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aman Popup addon for Ninja Forms popup-addon-for-ninja-forms allows DOM-Based XSS.This issue affects Popup addon for Ninja Forms: from n/a through <= 3.4.

    Aman Popup addon for Ninja Forms
  • High 8.8
    CVE-2025-53277

    WordPress IS-theme-companion plugin <= 1.59 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Infigo Software IS-theme-companion weblizar-companion allows Object Injection.This issue affects IS-theme-companion: from n/a through <= 1.59.

    Infigo Software IS-theme-companion
  • Medium 6.5
    CVE-2025-53278

    WordPress WP AdCenter plugin <= 2.6.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue affects WP AdCenter: from n/a through <= 2.6.0.

    WPeka WP AdCenter
  • Medium 6.5
    CVE-2025-53276

    WordPress Omnipress plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in omnipressteam Omnipress omnipress allows DOM-Based XSS.This issue affects Omnipress: from n/a through <= 1.6.4.

    omnipressteam Omnipress
  • High 7.1
    CVE-2025-53274

    WordPress WP Permalink Translator plugin <= 1.7.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Hossin Asaadi WP Permalink Translator wp-permalink-translator allows Stored XSS.This issue affects WP Permalink Translator: from n/a through <= 1.7.6.

    Hossin Asaadi WP Permalink Translator
  • Medium 6.5
    CVE-2025-53275

    WordPress Leyka plugin <= 3.32.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VaultDweller Leyka leyka allows DOM-Based XSS.This issue affects Leyka: from n/a through <= 3.32.1.

    VaultDweller Leyka
  • Medium 4.3
    CVE-2025-53273

    WordPress Slickstream plugin <= 2.0.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Slickstream Slickstream slick-engagement allows Cross Site Request Forgery.This issue affects Slickstream: from n/a through <= 2.0.3.

    Slickstream Slickstream
  • High 7.1
    CVE-2025-53271

    WordPress Additional Order Filters for WooCommerce plugin <= 1.22 - Cross Site Request Forgery (CSRF) to Stored XSS Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Anton Bond Additional Order Filters for WooCommerce additional-order-filters-for-woocommerce allows Stored XSS.This issue affects Additional Order Filters for WooCommerce: from n/a through <= 1.22.

    Anton Bond Additional Order Filters for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-53272

    WordPress Image Cleanup plugin <= 1.9.2 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in opicron Image Cleanup image-cleanup allows Cross Site Request Forgery.This issue affects Image Cleanup: from n/a through <= 1.9.2.

    opicron Image Cleanup
  • Medium 4.3
    CVE-2025-53269

    WordPress My Wp Brand plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in imw3 My Wp Brand my-wp-brand allows Cross Site Request Forgery.This issue affects My Wp Brand: from n/a through <= 1.1.3.

    imw3 My Wp Brand
  • Medium 4.3
    CVE-2025-53270

    WordPress CTA plugin <= 1.7.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Blend Media WordPress CTA easy-sticky-sidebar allows Cross Site Request Forgery.This issue affects WordPress CTA: from n/a through <= 1.7.0.

    Blend Media WordPress CTA Web / CMS
  • Medium 4.3
    CVE-2025-53268

    WordPress Import external attachments plugin <= 1.5.12 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Cross Site Request Forgery.This issue affects Import external attachments: from n/a through <= 1.5.12.

    ryanpcmcquen Import external attachments
  • Medium 4.3
    CVE-2025-53267

    WordPress Hide Admin Bar From Front End plugin <= 1.0.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Aftab Husain Hide Admin Bar From Front End hide-admin-bar-from-front-end allows Cross Site Request Forgery.This issue affects Hide Admin Bar From Front End: from n/a through <= 1.0.0.

    Aftab Husain Hide Admin Bar From Front End
  • Medium 4.3
    CVE-2025-53266

    WordPress Cron Logger plugin <= 1.3.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in EdwardBock Cron Logger cron-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cron Logger: from n/a through <= 1.3.0.

    EdwardBock Cron Logger
  • Medium 4.3
    CVE-2025-53264

    WordPress ONet Regenerate Thumbnails plugin <= 1.5 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Konrád Koller ONet Regenerate Thumbnails onet-regenerate-thumbnails allows Cross Site Request Forgery.This issue affects ONet Regenerate Thumbnails: from n/a through <= 1.5.

    Konrád Koller ONet Regenerate Thumbnails
  • Medium 5.4
    CVE-2025-53265

    WordPress Virusdie plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Virusdie Virusdie virusdie allows Cross Site Request Forgery.This issue affects Virusdie: from n/a through <= 1.1.3.

    virusdie Virusdie
  • Medium 5.4
    CVE-2025-53263

    WordPress Address Autocomplete via Google for Gravity Forms plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in PluginsCafe Address Autocomplete via Google for Gravity Forms gf-google-address-autocomplete allows Cross Site Request Forgery.This issue affects Address Autocomplete via Google for Gravity Forms: from n/a th…

    PluginsCafe Address Autocomplete via Google for Gravity Forms
  • Medium 4.3
    CVE-2025-53261

    WordPress WP YouTube Live plugin <= 1.10.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in macbookandrew WP YouTube Live wp-youtube-live allows Cross Site Request Forgery.This issue affects WP YouTube Live: from n/a through <= 1.10.0.

    macbookandrew WP YouTube Live
  • Medium 5.4
    CVE-2025-53262

    WordPress Writesonic plugin <= 1.0.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Writesonic Writesonic writesonic allows Cross Site Request Forgery.This issue affects Writesonic: from n/a through <= 1.0.5.

    Writesonic Writesonic
  • Critical 9.1
    CVE-2025-53260

    WordPress File Manager Plugin For Wordpress plugin <= 7.5 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in getredhawkstudio File Manager Plugin For Wordpress file-manager-plugin-for-wordpress allows Upload a Web Shell to a Web Server.This issue affects File Manager Plugin For Wordpress: from n/a thro…

    getredhawkstudio File Manager Plugin For Wordpress Web / CMS
  • High 7.5
    CVE-2025-53259

    WordPress Hotel Booking plugin <= 3.7 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.7.

    nicdark Hotel Booking
  • High 7.6
    CVE-2025-53258

    WordPress Hover Effects plugin <= 2.1.2 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Wow-Company Hover Effects hover-effects allows SQL Injection.This issue affects Hover Effects: from n/a through <= 2.1.2.

    Wow-Company Hover Effects
  • High 7.5
    CVE-2025-53257

    WordPress Gmedia Photo Gallery plugin <= 1.23.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Serhii Pasyuk Gmedia Photo Gallery grand-media allows PHP Local File Inclusion.This issue affects Gmedia Photo Gallery: from n/a through <…

    Serhii Pasyuk Gmedia Photo Gallery
  • High 7.6
    CVE-2025-53256

    WordPress YaySMTP plugin <= 2.6.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in YayCommerce YaySMTP yaysmtp allows SQL Injection.This issue affects YaySMTP: from n/a through <= 2.6.6.

    YayCommerce YaySMTP
  • Medium 5.3
    CVE-2025-53255

    WordPress HurryTimer plugin <= 2.13.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Nabil Lemsieh HurryTimer hurrytimer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HurryTimer: from n/a through <= 2.13.1.

    Nabil Lemsieh HurryTimer
  • Medium 5.9
    CVE-2025-53253

    WordPress WP Edit plugin <= 4.0.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Josh WP Edit wp-edit allows Stored XSS.This issue affects WP Edit: from n/a through <= 4.0.4.

    Josh WP Edit
  • Medium 4.3
    CVE-2025-53254

    WordPress Cyrlitera plugin <= 1.3.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Cyrlitera cyrlitera allows Cross Site Request Forgery.This issue affects Cyrlitera: from n/a through <= 1.3.0.

    themeisle Cyrlitera