Skip to content
OpenAdvisories

Archive

20 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /20 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

274 results · Feed

  • Medium 6.5
    CVE-2025-53985

    WordPress JetTabs <= 2.2.9 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTabs jet-tabs allows Retrieve Embedded Sensitive Data.This issue affects JetTabs: from n/a through <= 2.2.9.

    Crocoblock JetTabs
  • Medium 6.5
    CVE-2025-53987

    WordPress JetMenu <= 2.4.11.1 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetMenu jet-menu allows Retrieve Embedded Sensitive Data.This issue affects JetMenu: from n/a through <= 2.4.11.1.

    Crocoblock JetMenu
  • Medium 6.5
    CVE-2025-53988

    WordPress JetBlocks For Elementor <= 1.3.18 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Retrieve Embedded Sensitive Data.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.

    Crocoblock JetBlocks For Elementor
  • Medium 6.5
    CVE-2025-53992

    WordPress JetTricks <= 1.5.4.1 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetTricks jet-tricks allows Retrieve Embedded Sensitive Data.This issue affects JetTricks: from n/a through <= 1.5.4.1.

    Crocoblock JetTricks
  • Medium 6.5
    CVE-2025-53993

    WordPress JetPopup plugin <= 2.0.15 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetPopup jet-popup allows Retrieve Embedded Sensitive Data.This issue affects JetPopup: from n/a through <= 2.0.15.

    Crocoblock JetPopup
  • Medium 6.5
    CVE-2025-53998

    WordPress JetWooBuilder <= 2.1.20 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows Retrieve Embedded Sensitive Data.This issue affects JetWooBuilder: from n/a through <= 2.1.20.

    Crocoblock JetWooBuilder
  • High 8.8
    CVE-2025-54007

    WordPress Post Grid and Gutenberg Blocks Plugin <= 2.3.11 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Object Injection.This issue affects Post Grid and Gutenberg Blocks: from n/a through <= 2.3.11.

    PickPlugins Post Grid and Gutenberg Blocks
  • High 7.2
    CVE-2025-54012

    WordPress Welcart e-Commerce Plugin <= 2.11.16 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in info@welcart Welcart e-Commerce usc-e-shop allows Object Injection.This issue affects Welcart e-Commerce: from n/a through <= 2.11.16.

    info@welcart Welcart e-Commerce
  • Medium 6.5
    CVE-2025-54008

    WordPress JetSmartFilters <= 3.6.7 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Retrieve Embedded Sensitive Data.This issue affects JetSmartFilters: from n/a through <= 3.6.7.

    Crocoblock JetSmartFilters
  • High 7.5
    CVE-2025-54017

    WordPress Paid Member Subscriptions <= 2.15.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscription…

    Cozmoslabs Paid Member Subscriptions
  • Critical 9.8
    CVE-2025-54014

    WordPress MediCenter - Health Medical Clinic <= 15.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in QuanticaLabs MediCenter - Health Medical Clinic medicenter allows Object Injection.This issue affects MediCenter - Health Medical Clinic: from n/a through <= 15.1.

    QuanticaLabs MediCenter - Health Medical Clinic
  • High 7.5
    CVE-2025-54021

    WordPress Simple File List plugin <= 6.1.14 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Mitchell Bennis Simple File List simple-file-list allows Path Traversal.This issue affects Simple File List: from n/a through <= 6.1.14.

    Mitchell Bennis Simple File List
  • Medium 6.5
    CVE-2025-54019

    WordPress Alone < 7.8.5 - Arbitrary Code Execution Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Code Injection.This issue affects Alone: from n/a through < 7.8.5.

    Beplusthemes Alone
  • High 7.1
    CVE-2025-54027

    WordPress Support Board <= 3.8.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Schiocco Support Board supportboard allows Reflected XSS.This issue affects Support Board: from n/a through <= 3.8.0.

    Schiocco Support Board
  • Medium 6.5
    CVE-2025-54025

    WordPress Coupon Affiliates Plugin <= 6.4.0 - Settings Change Vulnerability

    Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coupon Affiliates: from n/a through <= 6.4.0.

    Elliot Sowersby / RelyWP Coupon Affiliates
  • High 7.5
    CVE-2025-54028

    WordPress CF7 WOW Styler Plugin <= 1.7.2 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Saleswonder Team: Tobias CF7 WOW Styler cf7-styler allows PHP Local File Inclusion.This issue affects CF7 WOW Styler: from n/a through <= …

    Saleswonder Team: Tobias CF7 WOW Styler
  • High 7.1
    CVE-2025-54032

    WordPress Real Estate Manager Pro Plugin <= 12.7.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebCodingPlace Real Estate Manager Pro real-estate-manager-pro allows Reflected XSS.This issue affects Real Estate Manager Pro: from n/a through <= 12.7.3.

    WebCodingPlace Real Estate Manager Pro
  • High 8.1
    CVE-2025-54031

    WordPress Support Board <= 3.8.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Schiocco Support Board supportboard allows PHP Local File Inclusion.This issue affects Support Board: from n/a through <= 3.8.0.

    Schiocco Support Board
  • High 7.5
    CVE-2025-54034

    WordPress Newsletters plugin <= 4.10 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Tribulant Software Newsletters newsletters-lite allows PHP Local File Inclusion.This issue affects Newsletters: from n/a through <= 4.10.

    Tribulant Software Newsletters
  • Medium 6.5
    CVE-2025-54040

    WordPress Webba Booking <= 5.1.20 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 5.1.20.

    Webba Appointment Booking Webba Booking
  • High 7.1
    CVE-2025-54044

    WordPress Elite Video Player <= 10.0.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in _CreativeMedia_ Elite Video Player elite-video-player allows Reflected XSS.This issue affects Elite Video Player: from n/a through <= 10.0.5.

    _CreativeMedia_ Elite Video Player
  • Medium 6.5
    CVE-2025-54046

    WordPress Cost Calculator Plugin <= 7.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Cost Calculator ql-cost-calculator allows Stored XSS.This issue affects Cost Calculator: from n/a through <= 7.4.

    QuanticaLabs Cost Calculator
  • Critical 9.3
    CVE-2025-54048

    WordPress Custom API for WP <= 4.2.2 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniOrange Custom API for WP custom-api-for-wp allows SQL Injection.This issue affects Custom API for WP: from n/a through <= 4.2.2.

    miniOrange Custom API for WP
  • Critical 9.9
    CVE-2025-54049

    WordPress Custom API for WP <= 4.2.2 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in miniOrange Custom API for WP custom-api-for-wp allows Privilege Escalation.This issue affects Custom API for WP: from n/a through <= 4.2.2.

    miniOrange Custom API for WP
  • High 7.5
    CVE-2025-54052

    WordPress Realtyna Organic IDX plugin <= 5.0.0 - Local File Inclusion Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Realtyna Realtyna Organic IDX plugin real-estate-listing-realtyna-wpl allows PHP Local File Inclusion.This issue affects Realtyna Organic IDX plugin: from n/a through <= 5.0.0.

    Realtyna Realtyna Organic IDX plugin
  • High 7.1
    CVE-2025-54055

    WordPress Druco <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Druco druco allows Reflected XSS.This issue affects Druco: from n/a through <= 1.5.2.

    skygroup Druco
  • Medium 6.6
    CVE-2025-54053

    WordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through <= 4.2.2.

    Adrian Tobey Groundhogg
  • High 7.1
    CVE-2025-54056

    WordPress Responsive HTML5 Audio Player PRO With Playlist <= 3.5.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Responsive HTML5 Audio Player PRO With Playlist lbg-audio2-html5 allows Reflected XSS.This issue affects Responsive HTML5 Audio Player PRO With …

    LambertGroup Responsive HTML5 Audio Player PRO With Playlist
  • High 7.1
    CVE-2025-54670

    WordPress oik Plugin <= 4.15.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows Reflected XSS.This issue affects oik: from n/a through <= 4.15.2.

    bobbingwide oik
  • Critical 9.1
    CVE-2025-54677 Public exploit

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita Plugin <= 4.5.3 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Using Malicious Files.This issue affects Online Booking & Scheduling Calendar for WordPress by…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Critical 9.8
    CVE-2025-54713

    WordPress Taxi Booking Manager for WooCommerce plugin <= 1.3.0 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in magepeopleteam Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Authentication Abuse.This issue affects Taxi Booking Manager for WooCommerce: from n/a through <= 1.…

    MagePeople Team Taxi Booking Manager for WooCommerce Web / CMS
  • Critical 9.3
    CVE-2025-54726 Public exploit Scanner template

    WordPress JS Archive List Plugin < 6.1.6 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Miguel Useche JS Archive List jquery-archive-list-widget allows SQL Injection.This issue affects JS Archive List: from n/a through < 6.1.6.

    Miguel Useche JS Archive List
  • High 8.8
    CVE-2025-54735

    WordPress CubeWP Framework Plugin <= 1.1.24 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Privilege Escalation.This issue affects CubeWP: from n/a through <= 1.1.24.

    Imran Tauqeer CubeWP
  • High 7.5
    CVE-2025-54750

    WordPress Funnel Builder by FunnelKit Plugin <= 3.11.1 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Aman Funnel Builder by FunnelKit funnel-builder allows PHP Local File Inclusion.This issue affects Funnel Builder by FunnelKit: from n/a t…

    Aman Funnel Builder by FunnelKit
  • High 7.5
    CVE-2025-55715

    WordPress Otter - Gutenberg Block Plugin <= 3.1.0 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Themeisle Otter - Gutenberg Block otter-blocks allows Retrieve Embedded Sensitive Data.This issue affects Otter - Gutenberg Block: from n/a through <= 3.1.0.

    themeisle Otter - Gutenberg Block
  • Medium 5.5
    CVE-2025-9225

    Cross-site scripting (XSS) in MiR robots and MiR fleet

    Stored cross-site scripting (XSS) in the web interface of MiR software versions prior to 3.0.0 on MiR Robots and MiR Fleet allows execution of arbitrary JavaScript code in a victim’s browser

    Mobile Industrial Robots MiR Robots MiR Fleet
  • Medium 4.3
    CVE-2025-9202

    ColorMag <= 4.0.19 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation

    The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() function in all versions up to, and including, 4.0.19. This makes it possible for authenticated attack…

    ThemeGrill ColorMag Web / CMS
  • Medium 4.3
    CVE-2025-54551

    Synapse Mobility 8.0, 8.0.1, 8.0.2, 8.1, and 8.1.1 contain a privilege escalation vulnerability through external contro…

    FUJIFILM Healthcare Americas Synapse Mobility
  • Medium 6.4
    CVE-2025-8618

    WPC Smart Quick View for WooCommerce <= 4.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via woosq_btn Shortcode

    The WPC Smart Quick View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's woosq_btn shortcode in all versions up to, and including, 4.2.1 due to insufficient input sanitization and output escaping on user supp…

    wpclever WPC Smart Quick View for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-55706

    URL redirection to untrusted site ('Open Redirect') issue exists in Movable Type. If this vulnerability is exploited, a…

    Six Apart Movable Type Premium Cloud Edition Movable Type Cloud Edition Movable Type Premium (Advanced Edition) (Software Edition)