Skip to content
OpenAdvisories

Archive

July 2025

Vulnerabilities first published in this month (UTC), newest first.

← June 2025 2025 / July August 2025 →
  1. 189
  2. 284
  3. 3149
  4. 4187
  5. 58
  6. 628
  7. 7175
  8. 8440
  9. 9110
  10. 10214
  11. 1196
  12. 1249
  13. 1349
  14. 14127
  15. 15156
  16. 16190
  17. 1789
  18. 18110
  19. 1946
  20. 2066
  21. 21237
  22. 22119
  23. 2394
  24. 2478
  25. 25219
  26. 2645
  27. 2741
  28. 28124
  29. 29175
  30. 3088
  31. 31114
All Critical High Medium Low Exploited only Public exploit

1,456 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-30959

    WordPress Product XML Feed Manager for WooCommerce <= 2.9.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WPFactory Product XML Feed Manager for WooCommerce product-xml-feeds-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product XML Feed Manager for WooCommerce: fr…

    WPFactory Product XML Feed Manager for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-48339

    WordPress Profiler - What Slowing Down Your WP <= 1.0.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in activity-log.com Profiler - What Slowing Down Your WP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Profiler - What Slowing Down Your WP: from n/a through 1.0.0.

    activity-log.com Profiler - What Slowing Down Your WP
  • Medium 6.5
    CVE-2025-49319

    WordPress Wishlist for WooCommerce <= 3.2.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WPFactory Wishlist for WooCommerce wish-list-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wishlist for WooCommerce: from n/a through <= 3.2.3.

    WPFactory Wishlist for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-49884

    WordPress Internal Linking of Related Contents plugin <= 1.1.8 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in alexvtn Internal Linking of Related Contents internal-linking-of-related-contents allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Internal Linking of Related Contents: from n/a …

    alexvtn Internal Linking of Related Contents
  • Medium 6.5
    CVE-2025-50028

    WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CodeSolz Ultimate Push Notifications ultimate-push-notifications allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Push Notifications: from n/a through <= 1.2.0.

    codesolz Ultimate Push Notifications
  • Medium 5.1
    CVE-2025-53755

    Cleartext Storage Vulnerability in Digisol DG-GR6821AC Router

    This vulnerability exists in Digisol DG-GR6821AC Router due to storage of credentials and PINS without encryption in the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and reverse engineer the bin…

    Digisol XPON ONU Wi-Fi Router (DG-GR6821AC)
  • Medium 5.1
    CVE-2025-53754

    Hard-coded Credentials Vulnerability in Digisol DG-GR6821AC Router

    This vulnerability exists in Digisol DG-GR6821AC Router due to hard-coded Root Access Credentials in system configuration of the device firmware. An attacker with physical access could exploit this vulnerability by extracting the firmware and analyzing the bi…

    Digisol XPON ONU Wi-Fi Router (DG-GR6821AC)
  • Medium 6.1
    CVE-2024-10032

    Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console

    In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.

    Eclipse Foundation Eclipse Glassfish org.glassfish.main.admingui:console-cluster-plugin Maven
  • Medium 5.8
    CVE-2024-10031

    Eclipse GlassFish is vulnerable to Stored XSS attacks through configuration file modifications

    In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site Scripting attacks by modifying the configuration file in the underlying operating system.

    Eclipse Foundation Eclipse Glassfish org.glassfish.main.admingui:console-common Maven
  • Medium 4.5
    CVE-2024-10029

    Eclipse GlassFish is vulnerable to Reflected XSS attacks through its Administration Console

    In Eclipse GlassFish version 7.0.15 is possible to perform Reflected Cross-site scripting attacks in the Administration Console.

    Eclipse Foundation Eclipse Glassfish org.glassfish.main.admingui:console-common org.glassfish.main.admingui:console-cluster-plugin Maven
  • Medium 6.1
    CVE-2024-9343

    Eclipse GlassFish is vulnerable to Stored XSS attacks through its Administration Console

    In Eclipse GlassFish version 7.0.15 is possible to perform Stored Cross-site scripting attacks in the Administration Console.

    Eclipse Foundation Eclipse Glassfish org.glassfish.main.admingui:console-common Maven
  • Medium 4.3
    CVE-2025-48150

    WordPress Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin plugin <= 4.48 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin real-estate-right-now allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real Estate Property 202…

    sminozzi Real Estate Property 2024 Create Your Own Fields and Search Bar WP Plugin
  • Medium 5.3
    CVE-2025-48155

    WordPress Residential Address Detection plugin <= 2.5.9 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in enituretechnology Residential Address Detection residential-address-detection allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Residential Address Detection: from n/a through <= 2.5.9.

    Eniture technology Residential Address Detection
  • Medium 6.5
    CVE-2025-48156

    WordPress Image Wall plugin <= 3.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Parakoos Image Wall image-wall allows Stored XSS.This issue affects Image Wall: from n/a through <= 3.1.

    Parakoos Image Wall
  • Medium 5.3
    CVE-2025-48166

    WordPress Stop and Block bots plugin Anti bots <= 1.48 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in sminozzi Stop and Block bots plugin Anti bots antibots allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Stop and Block bots plugin Anti bots: from n/a through <= 1.48.

    sminozzi Stop and Block bots plugin Anti bots
  • Medium 5.4
    CVE-2025-48167

    WordPress Chatbox Manager plugin <= 1.2.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in alexvtn Chatbox Manager wa-chatbox-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chatbox Manager: from n/a through <= 1.2.5.

    alexvtn Chatbox Manager
  • Medium 4.4
    CVE-2025-48294

    WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.

    Kerfred FG Drupal to WordPress Web / CMS
  • Medium 6.5
    CVE-2025-48295

    WordPress Easy Elementor Addons plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Stored XSS.This issue affects Easy Elementor Addons: from n/a through <= 2.2.5.

    HashThemes Easy Elementor Addons
  • Medium 6.5
    CVE-2025-54050

    WordPress Responsive Addons for Elementor plugin <= 1.7.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Addons for Elementor responsive-addons-for-elementor allows Stored XSS.This issue affects Responsive Addons for Elementor: from n/a th…

    cyberchimps Responsive Addons for Elementor
  • Medium 6.5
    CVE-2025-54051

    WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox Block lightbox-block allows Stored XSS.This issue affects LightBox Block: from n/a through <= 1.1.30.

    bPlugins LightBox Block
  • Medium 4.3
    CVE-2025-54047

    WordPress Cost Calculator plugin <= 7.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cost Calculator: from n/a through <= 7.4.

    QuanticaLabs Cost Calculator
  • Medium 4.3
    CVE-2025-54041

    WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Cross Site Request Forgery.This issue affects Wallet System for WooCommerce: from n/a through <= 2.6.7.

    WP Swings Wallet System for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-54042

    WordPress WP Post Hide plugin <= 1.0.9 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Xfinitysoft WP Post Hide wp-post-hide allows Cross Site Request Forgery.This issue affects WP Post Hide: from n/a through <= 1.0.9.

    Xfinity Soft WP Post Hide
  • Medium 4.3
    CVE-2025-54039

    WordPress Animator plugin <= 3.0.16 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Toast Plugins Animator scroll-triggered-animations allows Cross Site Request Forgery.This issue affects Animator: from n/a through <= 3.0.16.

    Toast Plugins Animator
  • Medium 5.4
    CVE-2025-54038

    WordPress Restaurant Menu by MotoPress plugin <= 2.4.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.6.

    jetmonsters Restaurant Menu by MotoPress
  • Medium 5.4
    CVE-2025-54037

    WordPress News Kit Elementor Addons plugin <= 1.3.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in blazethemes News Kit Elementor Addons news-kit-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects News Kit Elementor Addons: from n/a through <= 1.3.4.

    blazethemes News Kit Elementor Addons
  • Medium 4.3
    CVE-2025-54036

    WordPress Webba Booking plugin <= 5.1.20 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Cross Site Request Forgery.This issue affects Webba Booking: from n/a through <= 5.1.20.

    Webba Appointment Booking Webba Booking
  • Medium 4.3
    CVE-2025-54035

    WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This issue affects Newsletters: from n/a through <= 4.10.

    Tribulant Software Newsletters
  • Medium 6.5
    CVE-2025-54033

    WordPress Theme Builder For Elementor plugin <= 1.2.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in BlocksWP Theme Builder For Elementor theme-builder-for-elementor allows Cross Site Request Forgery.This issue affects Theme Builder For Elementor: from n/a through <= 1.2.3.

    BlocksWP Theme Builder For Elementor Web / CMS
  • Medium 4.3
    CVE-2025-54030

    WordPress WooCommerce Google Sheet Connector plugin <= 1.3.20 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WesternDeal WooCommerce Google Sheet Connector wc-gsheetconnector allows Cross Site Request Forgery.This issue affects WooCommerce Google Sheet Connector: from n/a through <= 1.3.20.

    westerndeal WooCommerce Google Sheet Connector Web / CMS
  • Medium 6.5
    CVE-2025-54024

    WordPress WPAdverts plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.This issue affects WPAdverts: from n/a through <= 2.2.5.

    Greg Winiarski WPAdverts
  • Medium 6.5
    CVE-2025-54023

    WordPress WP Delicious plugin <= 1.8.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows DOM-Based XSS.This issue affects WP Delicious: from n/a through <= 1.8.4.

    WP Delicious WP Delicious
  • Medium 6.5
    CVE-2025-54022

    WordPress Coupon Affiliates plugin <= 6.4.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Cross Site Request Forgery.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.

    Elliot Sowersby / RelyWP Coupon Affiliates
  • Medium 5.4
    CVE-2025-54020

    WordPress AntiSpam for Contact Form 7 plugin <= 0.6.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Erik AntiSpam for Contact Form 7 cf7-antispam allows Cross Site Request Forgery.This issue affects AntiSpam for Contact Form 7: from n/a through <= 0.6.3.

    Erik AntiSpam for Contact Form 7
  • Medium 6.5
    CVE-2025-54016

    WordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Gilman Videopack video-embed-thumbnail-generator allows DOM-Based XSS.This issue affects Videopack: from n/a through <= 4.10.3.

    Kyle Gilman Videopack
  • Medium 4.3
    CVE-2025-54018

    WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Pop-Up banners cm-pop-up-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Pop-Up banners: from n/a through <= 1.8.4.

    CreativeMindsSolutions CM Pop-Up banners
  • Medium 5.9
    CVE-2025-54013

    WordPress Welcart e-Commerce plugin <= 2.11.16 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Stored XSS.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.

    info@welcart Welcart e-Commerce
  • Medium 6.6
    CVE-2025-54015

    WordPress HT Contact Form 7 plugin <= 2.0.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.…

    HT Plugins HT Contact Form 7
  • Medium 4.3
    CVE-2025-54011

    WordPress SMTP2GO plugin <= 1.12.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in SMTP2GO SMTP2GO smtp2go allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMTP2GO: from n/a through <= 1.12.1.

    smtp2go SMTP2GO
  • Medium 6.5
    CVE-2025-54006

    WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through <= 5.4.1.

    Bold Themes Bold Page Builder