Skip to content
OpenAdvisories

Archive

16 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /16 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

91 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-48155

    WordPress Residential Address Detection plugin <= 2.5.9 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Residential Address Detection: from n/a through <= 2.5.9.

    Eniture technology Residential Address Detection
  • Medium 6.5
    CVE-2025-48156

    WordPress Image Wall plugin <= 3.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall image-wall allows Stored XSS.This issue affects Image Wall: from n/a through <= 3.1.

    Parakoos Image Wall
  • Medium 5.3
    CVE-2025-48166

    WordPress Stop and Block bots plugin Anti bots <= 1.48 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in sminozzi Stop and Block bots plugin Anti bots antibots allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Stop and Block bots plugin Anti bots: from n/a through <= 1.48.

    sminozzi Stop and Block bots plugin Anti bots
  • Medium 5.4
    CVE-2025-48167

    WordPress Chatbox Manager plugin <= 1.2.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chatbox Manager: from n/a through <= 1.2.5.

    alexvtn Chatbox Manager
  • Medium 4.4
    CVE-2025-48294

    WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.

    Kerfred FG Drupal to WordPress Web / CMS
  • Medium 6.5
    CVE-2025-48295

    WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.5.

    HashThemes Easy Elementor Addons
  • Medium 6.5
    CVE-2025-54050

    WordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Stored XSS.This issue affects Responsive Addons for Elementor: from n/a th…

    cyberchimps Responsive Addons for Elementor
  • Medium 6.5
    CVE-2025-54051

    WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.

    bPlugins LightBox Block
  • Medium 4.3
    CVE-2025-54047

    WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through <= 7.4.

    QuanticaLabs Cost Calculator
  • Medium 4.3
    CVE-2025-54041

    WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through <= 2.6.7.

    WP Swings Wallet System for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-54042

    WordPress WP Post Hide plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Xfinitysoft WP Post Hide wp-post-hide allows Cross Site Request Forgery.This issue affects WP Post Hide: from n/a through <= 1.0.9.

    Xfinity Soft WP Post Hide
  • Medium 4.3
    CVE-2025-54039

    WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Animator scroll-triggered-animations allows Cross Site Request Forgery.This issue affects Animator: from n/a through <= 3.0.16.

    Toast Plugins Animator
  • Medium 5.4
    CVE-2025-54038

    WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.6.

    jetmonsters Restaurant Menu by MotoPress
  • Medium 5.4
    CVE-2025-54037

    WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.3.4.

    blazethemes News Kit Elementor Addons
  • Medium 4.3
    CVE-2025-54036

    WordPress Webba Booking plugin <= 5.1.20 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Cross Site Request Forgery.This issue affects Webba Booking: from n/a through <= 5.1.20.

    Webba Appointment Booking Webba Booking
  • Medium 4.3
    CVE-2025-54035

    WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through <= 4.10.

    Tribulant Software Newsletters
  • Medium 6.5
    CVE-2025-54033

    WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in BlocksWP Theme Builder For Elementor theme-builder-for-elementor allows Cross Site Request Forgery.This issue affects Theme Builder For Elementor: from n/a through <= 1.2.3.

    BlocksWP Theme Builder For Elementor Web / CMS
  • Medium 4.3
    CVE-2025-54030

    WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This issue affects WooCommerce Google Sheet Connector: from n/a through <= 1.3.20.

    westerndeal WooCommerce Google Sheet Connector Web / CMS
  • Medium 6.5
    CVE-2025-54024

    WordPress WPAdverts plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.5.

    Greg Winiarski WPAdverts
  • Medium 6.5
    CVE-2025-54023

    WordPress WP Delicious plugin <= 1.8.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows DOM-Based XSS.This issue affects WP Delicious: from n/a through <= 1.8.4.

    WP Delicious WP Delicious
  • Medium 6.5
    CVE-2025-54022

    WordPress Coupon Affiliates plugin <= 6.4.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Cross Site Request Forgery.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.

    Elliot Sowersby / RelyWP Coupon Affiliates
  • Medium 5.4
    CVE-2025-54020

    WordPress AntiSpam for Contact Form 7 plugin <= 0.6.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Erik AntiSpam for Contact Form 7 cf7-antispam allows Cross Site Request Forgery.This issue affects AntiSpam for Contact Form 7: from n/a through <= 0.6.3.

    Erik AntiSpam for Contact Form 7
  • Medium 6.5
    CVE-2025-54016

    WordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Gilman Videopack video-embed-thumbnail-generator allows DOM-Based XSS.This issue affects Videopack: from n/a through <= 4.10.3.

    Kyle Gilman Videopack
  • Medium 4.3
    CVE-2025-54018

    WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through <= 1.8.4.

    CreativeMindsSolutions CM Pop-Up banners
  • Medium 5.9
    CVE-2025-54013

    WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.

    info@welcart Welcart e-Commerce
  • Medium 6.6
    CVE-2025-54015

    WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.…

    HT Plugins HT Contact Form 7
  • Medium 4.3
    CVE-2025-54011

    WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through <= 1.12.1.

    smtp2go SMTP2GO
  • Medium 6.5
    CVE-2025-54006

    WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.4.1.

    Bold Themes Bold Page Builder
  • Medium 6.5
    CVE-2025-54009

    WordPress JetSmartFilters plugin <= 3.6.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through <= 3.6.8.

    Crocoblock JetSmartFilters
  • Medium 6.5
    CVE-2025-53996

    WordPress JetSearch plugin <= 3.5.10.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSearch jet-search allows Stored XSS.This issue affects JetSearch: from n/a through <= 3.5.10.1.

    Crocoblock JetSearch
  • Medium 4.3
    CVE-2025-53997

    WordPress Houzez theme <= 4.0.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.0.4.

    Fave Themes Houzez
  • Medium 6.5
    CVE-2025-53995

    WordPress JetPopup plugin <= 2.0.15.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows Stored XSS.This issue affects JetPopup: from n/a through <= 2.0.15.1.

    Crocoblock JetPopup
  • Medium 6.5
    CVE-2025-53994

    WordPress JetPopup plugin <= 2.0.15 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetPopup jet-popup allows DOM-Based XSS.This issue affects JetPopup: from n/a through <= 2.0.15.

    Crocoblock JetPopup
  • Medium 6.5
    CVE-2025-53991

    WordPress JetTricks plugin <= 1.5.4.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTricks jet-tricks allows Stored XSS.This issue affects JetTricks: from n/a through <= 1.5.4.1.

    Crocoblock JetTricks
  • Medium 6.5
    CVE-2025-53989

    WordPress JetBlocks For Elementor plugin <= 1.3.19 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.19.

    Crocoblock JetBlocks For Elementor
  • Medium 5.3
    CVE-2025-53986

    WordPress Hestia theme <= 3.2.10 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themeisle Hestia hestia allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Hestia: from n/a through <= 3.2.10.

    themeisle Hestia
  • Medium 6.5
    CVE-2025-53984

    WordPress JetTabs plugin <= 2.2.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetTabs jet-tabs allows Stored XSS.This issue affects JetTabs: from n/a through <= 2.2.9.

    Crocoblock JetTabs
  • Medium 6.5
    CVE-2025-53982

    WordPress JetElements For Elementor plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.

    Crocoblock JetElements For Elementor
  • Medium 6.3
    CVE-2024-9342

    Eclipse GlassFish is vulnerable to Login Brute Force attacks through unlimited failed login attempts

    In Eclipse GlassFish versions before 8.0.3 it is possible to perform Login Brute Force attacks as there is no limitation in the number of failed login attempts. GlassFish 8.0.3 adds automatic attack protection documented in https://glassfish.org/docs/latest/s…

    Eclipse Foundation Eclipse Glassfish org.glassfish.main.admingui:console-common Maven
  • Medium 6.1
    CVE-2025-22227

    CVE-2025-22227: Authentication Leak On Redirect With Reactor Netty HTTP Client

    In some specific scenarios with chained redirects, Reactor Netty HTTP client leaks credentials. In order for this to happen, the HTTP client must have been explicitly configured to follow redirects.

    VMware Reactor Netty druid thingsboard-tb-node Wolfi Maven