Skip to content
OpenAdvisories

Archive

20 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /20 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

89 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-8102

    Easy Digital Downloads <= 3.5.0 - Cross-Site Request Forgery to Plugin Deactivation via edd_sendwp_disconnect and edd_sendwp_remote_install Functions

    The Easy Digital Downloads plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.0. This is due to missing nonce validations in the edd_sendwp_disconnect() and edd_sendwp_remote_install() functions. This ma…

    smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Web / CMS
  • Medium 4.3
    CVE-2025-57734

    In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files

    JetBrains TeamCity
  • Medium 5.5
    CVE-2025-57733

    In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content

    JetBrains TeamCity
  • Medium 5.2
    CVE-2025-57730

    In JetBrains IntelliJ IDEA before 2025.2 hTML injection was possible via Remote Development feature

    JetBrains IntelliJ IDEA
  • Medium 6.5
    CVE-2025-57729

    In JetBrains IntelliJ IDEA before 2025.2 unexpected plugin startup was possible due to automatic LSP server start

    JetBrains IntelliJ IDEA
  • Medium 6.5
    CVE-2025-57728

    In JetBrains IntelliJ IDEA before 2025.2 improper access control allowed Code With Me guest to discover hidden files

    JetBrains IntelliJ IDEA
  • Medium 4.7
    CVE-2025-57727

    In JetBrains IntelliJ IDEA before 2025.2 credentials disclosure was possible via remote reference

    JetBrains IntelliJ IDEA
  • Medium 6.3
    CVE-2024-39954

    Apache EventMesh Runtime: SSRF

    CWE-918 Server-Side Request Forgery (SSRF) in eventmesh-runtime module in WebhookUtil.java on windows\linux\mac os e.g. allows the attacker can abuse functionality on the server to read or update internal resources. Users are recommended to upgrade to version…

    Apache Software Foundation Apache EventMesh Runtime org.apache.eventmesh:eventmesh-runtime Maven
  • Medium 5.3
    CVE-2025-9229

    Information Disclosure in MiR robots and MiR fleet through verbose error pages

    Information disclosure vulnerability in error handling in MiR software prior to version 3.0.0 allows unauthenticated attackers to view detailed error information, such as file paths and other data, via access to verbose error pages.

    Mobile Industrial Robots MiR Robots MiR Fleet
  • Medium 4.3
    CVE-2025-9228

    Insufficient authorization when creating notes

    MiR software versions prior to version 3.0.0 have insufficient authorization controls when creating text notes, allowing low-privilege users to create notes which are intended only for administrative users.

    Mobile Industrial Robots MiR Robots MiR Fleet
  • Medium 6.5
    CVE-2025-49389

    WordPress Notice Bar Plugin <= 3.1.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WEN Solutions Notice Bar notice-bar allows Stored XSS.This issue affects Notice Bar: from n/a through <= 3.1.3.

    WEN Solutions Notice Bar
  • Medium 4.3
    CVE-2025-49391

    WordPress Sign-up Sheets Plugin <= 2.3.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Fetch Designs Sign-up Sheets sign-up-sheets allows Cross Site Request Forgery.This issue affects Sign-up Sheets: from n/a through <= 2.3.3.

    Fetch Designs Sign-up Sheets
  • Medium 6.5
    CVE-2025-49395

    WordPress Themify Icons Plugin <= 2.0.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Icons themify-icons allows Stored XSS.This issue affects Themify Icons: from n/a through <= 2.0.3.

    themifyme Themify Icons
  • Medium 5.9
    CVE-2025-49392

    WordPress Themify Audio Dock Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Audio Dock themify-audio-dock allows Stored XSS.This issue affects Themify Audio Dock: from n/a through <= 2.0.5.

    themifyme Themify Audio Dock
  • Medium 4.3
    CVE-2025-49396

    WordPress Themify Builder Plugin <= 7.6.7 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themify Builder: from n/a through <= 7.6.7.

    themifyme Themify Builder
  • Medium 6.5
    CVE-2025-49397

    WordPress Colorbox Lightbox Plugin <= 1.1.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noor Alam Colorbox Lightbox wp-colorbox allows Stored XSS.This issue affects Colorbox Lightbox: from n/a through <= 1.1.5.

    Noor Alam Colorbox Lightbox
  • Medium 6.5
    CVE-2025-47650

    WordPress Infility Global <= 2.15.06 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Infility Infility Global infility-global allows Path Traversal.This issue affects Infility Global: from n/a through <= 2.15.06.

    infility Infility Global
  • Medium 5.9
    CVE-2025-49412

    WordPress Page Transition plugin <= 1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in numixtech Page Transition page-transition allows Stored XSS.This issue affects Page Transition: from n/a through <= 1.3.

    numixtech Page Transition
  • Medium 5.3
    CVE-2025-49896

    WordPress WP Discord Post Plus – Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus – Supports Unlimited Channels: from n/a through 1.0.2.

    wptasker WP Discord Post Plus – Supports Unlimited Channels
  • Medium 6.5
    CVE-2025-53195

    WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-53196

    WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-53561

    WordPress Prevent files / folders access Plugin <= 2.6.0 - Path Traversal Vulnerability

    Path Traversal: '.../...//' vulnerability in miniOrange Prevent files / folders access prevent-file-access allows Path Traversal.This issue affects Prevent files / folders access: from n/a through <= 2.6.0.

    miniOrange Prevent files / folders access
  • Medium 6.5
    CVE-2025-53983

    WordPress JetElements For Elementor <= 2.7.7 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetElements For Elementor jet-elements allows Retrieve Embedded Sensitive Data.This issue affects JetElements For Elementor: from n/a through <= 2.7.7.

    Crocoblock JetElements For Elementor
  • Medium 6.5
    CVE-2025-53985

    WordPress JetTabs <= 2.2.9 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs jet-tabs allows Retrieve Embedded Sensitive Data.This issue affects JetTabs: from n/a through <= 2.2.9.

    Crocoblock JetTabs
  • Medium 6.5
    CVE-2025-53987

    WordPress JetMenu <= 2.4.11.1 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetMenu jet-menu allows Retrieve Embedded Sensitive Data.This issue affects JetMenu: from n/a through <= 2.4.11.1.

    Crocoblock JetMenu
  • Medium 6.5
    CVE-2025-53988

    WordPress JetBlocks For Elementor <= 1.3.18 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.

    Crocoblock JetBlocks For Elementor
  • Medium 6.5
    CVE-2025-53992

    WordPress JetTricks <= 1.5.4.1 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTricks jet-tricks allows Retrieve Embedded Sensitive Data.This issue affects JetTricks: from n/a through <= 1.5.4.1.

    Crocoblock JetTricks
  • Medium 6.5
    CVE-2025-53993

    WordPress JetPopup plugin <= 2.0.15 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetPopup jet-popup allows Retrieve Embedded Sensitive Data.This issue affects JetPopup: from n/a through <= 2.0.15.

    Crocoblock JetPopup
  • Medium 6.5
    CVE-2025-53998

    WordPress JetWooBuilder <= 2.1.20 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Retrieve Embedded Sensitive Data.This issue affects JetWooBuilder: from n/a through <= 2.1.20.

    Crocoblock JetWooBuilder
  • Medium 6.5
    CVE-2025-54008

    WordPress JetSmartFilters <= 3.6.7 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Retrieve Embedded Sensitive Data.This issue affects JetSmartFilters: from n/a through <= 3.6.7.

    Crocoblock JetSmartFilters
  • Medium 6.5
    CVE-2025-54019

    WordPress Alone < 7.8.5 - Arbitrary Code Execution Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through < 7.8.5.

    Beplusthemes Alone
  • Medium 6.5
    CVE-2025-54025

    WordPress Coupon Affiliates Plugin <= 6.4.0 - Settings Change Vulnerability

    Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.

    Elliot Sowersby / RelyWP Coupon Affiliates
  • Medium 6.5
    CVE-2025-54040

    WordPress Webba Booking <= 5.1.20 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 5.1.20.

    Webba Appointment Booking Webba Booking
  • Medium 6.5
    CVE-2025-54046

    WordPress Cost Calculator Plugin <= 7.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Stored XSS.This issue affects Cost Calculator: from n/a through <= 7.4.

    QuanticaLabs Cost Calculator
  • Medium 6.6
    CVE-2025-54053

    WordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through <= 4.2.2.

    Adrian Tobey Groundhogg
  • Medium 5.5
    CVE-2025-9225

    Cross-site scripting (XSS) in MiR robots and MiR fleet

    Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaScript code in a victim’s browser

    Mobile Industrial Robots MiR Robots MiR Fleet
  • Medium 4.3
    CVE-2025-9202

    ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

    The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attack…

    ThemeGrill ColorMag Web / CMS
  • Medium 4.3
    CVE-2025-54551

    Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external contro…

    FUJIFILM Healthcare Americas Synapse Mobility
  • Medium 6.4
    CVE-2025-8618

    WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode

    The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supp…

    wpclever WPC Smart Quick View for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-55706

    URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, a…

    Six Apart Movable Type Premium Cloud Edition Movable Type Cloud Edition Movable Type Premium (Software Edition)