Skip to content
OpenAdvisories

Archive

June 2025

Vulnerabilities first published in this month (UTC), newest first.

← May 2025 2025 / June July 2025 →
  1. 119
  2. 2121
  3. 3116
  4. 4134
  5. 597
  6. 6344
  7. 715
  8. 833
  9. 9181
  10. 10490
  11. 1159
  12. 1280
  13. 1388
  14. 1421
  15. 1515
  16. 1695
  17. 17174
  18. 18414
  19. 1955
  20. 20222
  21. 2157
  22. 2238
  23. 2374
  24. 24120
  25. 25120
  26. 26116
  27. 27225
  28. 2846
  29. 2948
  30. 3089
All Critical High Medium Low Exploited only Public exploit

3,706 results · Feed

  • High 7.1
    CVE-2025-49290

    WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) off-canvas-sidebars allows Reflected XSS.This issue affects Off-Canvas Sidebars & Menus (Slidebars): fr…

    Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars)
  • High 8.1
    CVE-2025-49883

    WordPress Greenmart theme <= 4.2.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Greenmart greenmart allows PHP Local File Inclusion.This issue affects Greenmart: from n/a through <= 4.2.3.

    thembay Greenmart
  • Critical 10.0
    CVE-2025-49885

    WordPress Drag and Drop Multiple File Upload (Pro) - WooCommerce plugin <= 5.0.6 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce drag-and-drop-file-upload-wc-pro allows Upload a Web Shell to a Web Server.This issue affects Drag and Drop Multiple File Upload …

    HaruTheme Drag and Drop Multiple File Upload (Pro) - WooCommerce Web / CMS
  • High 8.1
    CVE-2025-49886

    WordPress Zikzag Core plugin <= 1.4.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WebGeniusLab Zikzag Core zikzag-core allows PHP Local File Inclusion.This issue affects Zikzag Core: from n/a through <= 1.4.5.

    WebGeniusLab Zikzag Core
  • High 7.1
    CVE-2025-50052

    WordPress Flexo Counter plugin <= 1.0001 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in flexostudio Flexo Counter flexo-countdown allows Reflected XSS.This issue affects Flexo Counter: from n/a through <= 1.0001.

    flexostudio Flexo Counter
  • Critical 9.3
    CVE-2025-52717

    WordPress LifterLMS plugin <= 8.0.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in chrisbadgett LifterLMS lifterlms allows SQL Injection.This issue affects LifterLMS: from n/a through <= 8.0.6.

    chrisbadgett LifterLMS
  • High 8.1
    CVE-2025-52723

    WordPress Networker theme <= 1.2.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codesupplyco Networker networker allows PHP Local File Inclusion.This issue affects Networker: from n/a through <= 1.2.0.

    Code Supply Co. Networker
  • Critical 9.3
    CVE-2025-52722

    WordPress Classiera theme <= 4.0.34 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoinWebs Classiera classiera allows SQL Injection.This issue affects Classiera: from n/a through <= 4.0.34.

    JoinWebs Classiera
  • Critical 9.8
    CVE-2025-52725

    WordPress CouponXxL theme <= 3.0.0 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in pebas CouponXxL couponxxl allows Object Injection.This issue affects CouponXxL: from n/a through <= 3.0.0.

    pebas CouponXxL
  • Critical 9.8
    CVE-2025-52724

    WordPress Amwerk theme <= 1.2.0 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in BoldThemes Amwerk amwerk allows Object Injection.This issue affects Amwerk: from n/a through <= 1.2.0.

    Bold Themes Amwerk
  • High 8.6
    CVE-2025-52726

    WordPress CouponXxL Custom Post Types plugin <= 3.0 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in pebas CouponXxL Custom Post Types couponxxl-cpt allows Privilege Escalation.This issue affects CouponXxL Custom Post Types: from n/a through <= 3.0.

    pebas CouponXxL Custom Post Types
  • High 8.1
    CVE-2025-52729

    WordPress Diza theme <= 1.3.9 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Diza diza allows PHP Local File Inclusion.This issue affects Diza: from n/a through <= 1.3.9.

    thembay Diza
  • High 7.1
    CVE-2025-52727

    WordPress CSS3 Vertical Web Pricing Tables plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs CSS3 Vertical Web Pricing Tables css3_vertical_web_pricing_tables allows Reflected XSS.This issue affects CSS3 Vertical Web Pricing Tables: from…

    QuanticaLabs CSS3 Vertical Web Pricing Tables
  • High 7.1
    CVE-2025-52778

    WordPress xili-dictionary plugin <= 2.12.5.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michel - xiligroup dev xili-dictionary xili-dictionary allows Reflected XSS.This issue affects xili-dictionary: from n/a through <= 2.12.5.2.

    Michel - xiligroup dev xili-dictionary
  • High 7.1
    CVE-2025-52774

    WordPress Infility Global plugin <= 2.15.06 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infility Infility Global infility-global allows Reflected XSS.This issue affects Infility Global: from n/a through <= 2.15.06.

    infility Infility Global
  • High 7.1
    CVE-2025-52799

    WordPress LMS theme <= 9.2 - Reflected Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes LMS lms allows Reflected XSS.This issue affects LMS: from n/a through <= 9.2.

    Design themes LMS
  • High 8.1
    CVE-2025-52808

    WordPress RealtyElite theme <= 1.0.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in real-web RealtyElite realtyelite allows PHP Local File Inclusion.This issue affects RealtyElite: from n/a through <= 1.0.0.

    real-web RealtyElite
  • High 8.1
    CVE-2025-52809

    WordPress National Weather Service Alerts plugin <= 1.3.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in John Russell National Weather Service Alerts national-weather-service-alerts allows PHP Local File Inclusion.This issue affects National W…

    John Russell National Weather Service Alerts
  • High 8.1
    CVE-2025-52811

    WordPress Davenport - Versatile Blog and Magazine WordPress Theme <= 1.3 - Local File Inclusion Vulnerability

    Path Traversal: '.../...//' vulnerability in Creanncy Davenport - Versatile Blog and Magazine WordPress Theme davenport allows PHP Local File Inclusion.This issue affects Davenport - Versatile Blog and Magazine WordPress Theme: from n/a through <= 1.3.

    Creanncy Davenport - Versatile Blog and Magazine WordPress Theme Web / CMS
  • High 8.1
    CVE-2025-52810

    WordPress Katerio - Magazine theme <= 1.5.1 - Local File Inclusion Vulnerability

    Path Traversal vulnerability in TMRW-studio Katerio - Magazine allows PHP Local File Inclusion. This issue affects Katerio - Magazine: from n/a through 1.5.1.

    TMRW-studio Katerio - Magazine
  • High 8.1
    CVE-2025-52812

    WordPress Domnoo theme <= 1.49 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Domnoo domnoo allows PHP Local File Inclusion.This issue affects Domnoo: from n/a through <= 1.49.

    ApusWP Domnoo
  • High 8.1
    CVE-2025-52814

    WordPress BRW plugin <= 1.8.8 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme BRW ova-brw allows PHP Local File Inclusion.This issue affects BRW: from n/a through <= 1.8.7.

    Ovatheme BRW
  • High 8.1
    CVE-2025-52815

    WordPress CityGov theme <= 1.9 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes CityGov citygov allows PHP Local File Inclusion.This issue affects CityGov: from n/a through <= 1.9.

    AncoraThemes CityGov
  • High 8.1
    CVE-2025-52816

    WordPress Zita theme <= 1.6.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in themehunk Zita zita allows PHP Local File Inclusion.This issue affects Zita: from n/a through <= 1.6.5.

    ThemeHunk Zita
  • High 8.2
    CVE-2025-52817

    WordPress Abandoned Contact Form 7 plugin <= 2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ZealousWeb Abandoned Contact Form 7 abandoned-contact-form-7 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Abandoned Contact Form 7: from n/a through <= 2.2.

    ZealousWeb Abandoned Contact Form 7
  • High 8.2
    CVE-2025-52818

    WordPress Trusty Whistleblowing plugin <= 2.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Dejan Jasnic Trusty Whistleblowing trusty-whistleblowing-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trusty Whistleblowing: from n/a through <= 2.0.1.

    Dejan Jasnic Trusty Whistleblowing
  • High 8.8
    CVE-2025-52824

    WordPress Mobile DJ Manager plugin <= 1.7.8.3 - Privilege Escalation vulnerability

    Missing Authorization vulnerability in MDJM Mobile DJ Manager mobile-dj-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mobile DJ Manager: from n/a through <= 1.7.8.3.

    mdjm Mobile DJ Manager
  • High 8.8
    CVE-2025-52826

    WordPress Sala theme <= 1.1.3 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.

    uxper Sala
  • High 8.8
    CVE-2025-52827

    WordPress Nuss theme <= 1.3.3 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in uxper Nuss nuss allows Object Injection.This issue affects Nuss: from n/a through <= 1.3.3.

    uxper Nuss
  • Critical 9.3
    CVE-2025-52829

    WordPress DirectIQ Email Marketing plugin <= 2.0 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DirectIQ DirectIQ Email Marketing directiq-wp allows SQL Injection.This issue affects DirectIQ Email Marketing: from n/a through <= 2.0.

    DirectIQ DirectIQ Email Marketing
  • Critical 9.3
    CVE-2025-52834

    WordPress Homey theme <= 2.4.7 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in favethemes Homey homey allows SQL Injection.This issue affects Homey: from n/a through <= 2.4.7.

    Fave Themes Homey
  • High 8.1
    CVE-2023-25998

    WordPress Samex - Clean, Minimal Shop WooCommerce WordPress Theme <= 2.6 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme allows PHP Local File Inclusion. This issue affects Samex - Clean, Minima…

    snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme Web / CMS
  • High 7.1
    CVE-2025-23973

    WordPress SpecFit-Virtual Try On Woocommerce plugin <= 8.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugudlabs SpecFit-Virtual Try On Woocommerce try-on-for-woocommerce allows Stored XSS.This issue affects SpecFit-Virtual Try On Woocommerce: from n/a through…

    dugudlabs SpecFit-Virtual Try On Woocommerce Web / CMS
  • Critical 9.3
    CVE-2025-23967

    WordPress GG Bought Together for WooCommerce plugin <= 1.0.2 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpopal GG Bought Together for WooCommerce gg-bought-together allows SQL Injection.This issue affects GG Bought Together for WooCommerce: from n/a through <= …

    wpopal GG Bought Together for WooCommerce Web / CMS
  • High 8.1
    CVE-2025-24760

    WordPress Sofass theme <= 1.3.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in goalthemes Sofass sofass allows PHP Local File Inclusion.This issue affects Sofass: from n/a through <= 1.3.4.

    goalthemes Sofass
  • High 8.1
    CVE-2025-49416

    WordPress FW Gallery plugin <= 8.0.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fastw3b LLC FW Gallery fw-gallery allows PHP Local File Inclusion.This issue affects FW Gallery: from n/a through <= 8.0.0.

    Fastw3b FW Gallery
  • High 7.1
    CVE-2025-49423

    WordPress Bulk YouTube Post Creator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Tahir Ali Jan Bulk YouTube Post Creator bulk-youtube-post-creator allows Reflected XSS.This issue affects Bulk YouTube Post Creator: from n/a through <=…

    Syed Tahir Ali Jan Bulk YouTube Post Creator
  • High 8.6
    CVE-2025-49448

    WordPress FW Food Menu plugin <= 6.0.0 - Arbitrary File Deletion Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Fastw3b LLC FW Food Menu allows Path Traversal. This issue affects FW Food Menu : from n/a through 6.0.0.

    Fastw3b FW Food Menu
  • High 8.1
    CVE-2025-6763

    Comet System H3531 Web-based Management setupA.cfg missing authentication

    A vulnerability was found in Comet System T0510, T3510, T3511, T4511, T6640, T7511, T7611, P8510, P8552 and H3531 1.60. Affected by this issue is some unknown functionality of the file /setupA.cfg of the component Web-based Management Interface. Performing ma…

    Comet System T3510 T4511 T7511
  • Medium 6.3
    CVE-2025-6762

    diyhi bbs HTTP Header login getUrl server-side request forgery

    A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is pos…

    diyhi bbs