Skip to content
OpenAdvisories

Archive

16 July 2025

Vulnerabilities first published on this day (UTC), newest first.

← June 2025 2025 / July /16 August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

91 results · Clear filters · Feed

  • Medium 5.1
    CVE-2025-40724

    Stored Cross-Site Scripting (XSS) in Pharmacy POS PHP Script

    Stored Cross-Site Scripting (XSS) vulnerability in Pharmacy POS PHP Script. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the u_medicine_name parameter in /edit_medicine.ph…

    Pharmacy POS PHP Script Pharmacy POS PHP Script
  • Medium 6.4
    CVE-2025-7035

    Media Library Assistant <= 3.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_tag_cloud and mla_term_list Shortcodes

    The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mla_tag_cloud and mla_term_list shortcodes in all versions up to, and including, 3.26 due to insufficient input sanitization and output escaping on …

    dglingren Media Library Assistant Web / CMS
  • Medium 6.4
    CVE-2025-5284

    Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations <= 2.0.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Custom JS extension in all versions up to, and including, 2.0.8.2 due to ins…

    litonice13 Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Web / CMS
  • Medium 4.3
    CVE-2025-27465

    x86: Incorrect stubs exception handling for flags recovery

    Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructi…

    Xen Xen xen xen Virtualization Debian Ubuntu Alpine
  • Medium 6.4
    CVE-2025-6747

    Avada (Fusion) Builder <= 3.12.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'fusion_map' shortcode in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping on user supplied attri…

    ThemeFusion Avada (Fusion) Builder Web / CMS
  • Medium 6.4
    CVE-2025-5845

    Affiliate Reviews <= 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via numColumns Parameter

    The Affiliate Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘numColumns’ parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authentic…

    wpchop Affiliate Reviews Web / CMS
  • Medium 6.4
    CVE-2025-5843

    Brandfolder <= 5.0.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

    The Brandfolder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 5.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker…

    brandfolder Brandfolder – Digital Asset Management Simplified. Web / CMS
  • Medium 4.4
    CVE-2025-2799

    WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting

    The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tag-name’ parameter in all versions up to, and including, 3.1.49 due to insufficient input sanitiza…

    WP Event Manager WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce Web / CMS
  • Medium 4.5
    CVE-2025-53842

    Use of hard-coded credentials issue exists in ZWX-2000CSW2-HN prior to 0.3.19 and ZWX-2000CS2-HN firmware all versions.…

    ZEXELON ZWX-2000CSW2-HN ZWX-2000CS2-HN
  • Medium 6.1
    CVE-2025-6977

    ProfileGrid – User Profiles, Groups and Communities <= 5.9.5.4 - Reflected Cross-Site Scripting via 'pm_get_messenger_notification' function

    The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘pm_get_messenger_notification’ function in all versions up to, and including, 5.9.5.4 due to insufficient input sanitization …

    Metagauss ProfileGrid – User Profiles, Groups and Communities Web / CMS
  • Medium 5.4
    CVE-2024-42912

    A cross-site scripting (XSS) vulnerability in META-INF Kft. Email This Issue (Data Center) before 9.13.0-GA allows atta…