Skip to content
OpenAdvisories

Archive

28 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /28 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

99 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-48363

    WordPress Popup for CF7 with Sweet Alert plugin <= 1.6.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Metin Saraç Popup for CF7 with Sweet Alert cf7-sweet-alert-popup allows Cross Site Request Forgery.This issue affects Popup for CF7 with Sweet Alert: from n/a through <= 1.6.5.

    Metin Saraç Popup for CF7 with Sweet Alert
  • Medium 5.3
    CVE-2025-48361

    WordPress Hesabfa Accounting plugin <= 2.2.5 - Sensitive Data Exposure via Log File vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Retrieve Embedded Sensitive Data.This issue affects Hesabfa Accounting: from n/a through <= 2.2.5.

    Saeed Sattar Beglou Hesabfa Accounting
  • Medium 5.9
    CVE-2025-48360

    WordPress Varnish/Nginx Proxy Caching plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Razvan Stanga Varnish/Nginx Proxy Caching vcaching allows Stored XSS.This issue affects Varnish/Nginx Proxy Caching: from n/a through <= 1.8.3.

    Razvan Stanga Varnish/Nginx Proxy Caching
  • Medium 5.9
    CVE-2025-48358

    WordPress Risk Free Cash On Delivery (COD) – WooCommerce plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in everythingwp Risk Free Cash On Delivery (COD) – WooCommerce risk-free-cash-on-delivery-cod-woocommerce allows Stored XSS.This issue affects Risk Free Cash On…

    everythingwp Risk Free Cash On Delivery (COD) – WooCommerce Web / CMS
  • Medium 5.4
    CVE-2025-48357

    WordPress Century ToolKit plugin <= 1.2.1 - Cross Site Request Forgery (CSRF) to Arbitrary Plugin Activation vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Theme Century Century ToolKit century-toolkit allows Cross Site Request Forgery.This issue affects Century ToolKit: from n/a through <= 1.2.1.

    Theme Century Century ToolKit
  • Medium 6.5
    CVE-2025-48356

    WordPress Kanpress plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Isra Kanpress kanpress allows Stored XSS.This issue affects Kanpress: from n/a through <= 1.1.

    Isra Kanpress
  • Medium 6.5
    CVE-2025-48354

    WordPress Better Post & Filter Widgets for Elementor plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filte…

    WP Smart Widgets Better Post & Filter Widgets for Elementor
  • Medium 5.9
    CVE-2025-48352

    WordPress Yandex Site search pinger plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sitesearch-yandex Yandex Site search pinger yandex-pinger allows Stored XSS.This issue affects Yandex Site search pinger: from n/a through <= 1.5.

    sitesearch-yandex Yandex Site search pinger
  • Medium 4.3
    CVE-2025-48350

    WordPress AutoWP plugin <= 2.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7.

    Basar Ventures AutoWP
  • Medium 6.5
    CVE-2025-48349

    WordPress Video Gallery – Vimeo and YouTube Gallery plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in origincode Video Gallery – Vimeo and YouTube Gallery smart-grid-gallery allows Stored XSS.This issue affects Video Gallery – Vimeo and YouTube Gallery: from …

    origincode Video Gallery – Vimeo and YouTube Gallery
  • Medium 4.3
    CVE-2025-48348

    WordPress Site Offline plugin <= 1.5.7 - Broken Access Control vulnerability

    Incorrect Privilege Assignment vulnerability in chandrashekharsahu Site Offline site-offline allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Offline: from n/a through <= 1.5.7.

    Chandra Shekhar Sahu Site Offline
  • Medium 6.5
    CVE-2025-48347

    WordPress bxSlider integration for WordPress plugin <= 1.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vincent Mimoun-Prat bxSlider integration for WordPress bxslider-integration allows Stored XSS.This issue affects bxSlider integration for WordPress: from n/a…

    Vincent Mimoun-Prat bxSlider integration for WordPress Web / CMS
  • Medium 5.3
    CVE-2025-48327

    WordPress WP Mailgun SMTP plugin <= 1.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Mailgun SMTP: from n/a through <= 1.0.7.

    inkthemes WP Mailgun SMTP
  • Medium 5.9
    CVE-2025-48324

    WordPress tli.tl auto Twitter poster plugin <= 3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in khashabawy tli.tl auto Twitter poster tlitl-auto-twitter-poster allows Stored XSS.This issue affects tli.tl auto Twitter poster: from n/a through <= 3.4.

    khashabawy tli.tl auto Twitter poster
  • Medium 5.9
    CVE-2025-48323

    WordPress Advance Food Menu plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Md Abunaser Khan Advance Food Menu advance-food-menu allows Stored XSS.This issue affects Advance Food Menu: from n/a through <= 1.0.

    Md Abunaser Khan Advance Food Menu
  • Medium 6.5
    CVE-2025-48322

    WordPress Statify Widget plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Finn Dohrn Statify Widget statify-widget allows Stored XSS.This issue affects Statify Widget: from n/a through <= 1.4.6.

    Finn Dohrn Statify Widget
  • Medium 5.9
    CVE-2025-48319

    WordPress Mesa Mesa Reservation Widget plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gslauraspeck Mesa Mesa Reservation Widget mesa-mesa-reservation-widget allows Stored XSS.This issue affects Mesa Mesa Reservation Widget: from n/a through <=…

    gslauraspeck Mesa Mesa Reservation Widget
  • Medium 6.5
    CVE-2025-48316

    WordPress Responsive Mobile-Friendly Tooltip plugin <= 1.6.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ItayXD Responsive Mobile-Friendly Tooltip responsive-mobile-friendly-tooltip allows Stored XSS.This issue affects Responsive Mobile-Friendly Tooltip: from n/…

    ItayXD Responsive Mobile-Friendly Tooltip
  • Medium 4.3
    CVE-2025-48318

    WordPress 多说社会化评论框 plugin <= 1.2 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in shen2 多说社会化评论框 duoshuo allows Cross Site Request Forgery.This issue affects 多说社会化评论框: from n/a through <= 1.2.

    shen2
  • Medium 6.5
    CVE-2025-48315

    WordPress WordPress HTML plugin <= 0.51 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stanton119 WordPress HTML custom-html-bodyhead allows Stored XSS.This issue affects WordPress HTML: from n/a through <= 0.51.

    stanton119 WordPress HTML Web / CMS
  • Medium 5.9
    CVE-2025-48313

    WordPress Tripadvisor Shortcode plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kevin heath Tripadvisor Shortcode tripadvisor-shortcode allows Stored XSS.This issue affects Tripadvisor Shortcode: from n/a through <= 2.2.

    kevin heath Tripadvisor Shortcode
  • Medium 5.9
    CVE-2025-48314

    WordPress Add Code To Head plugin <= 1.17 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in salubrio Add Code To Head add-code-to-head allows Stored XSS.This issue affects Add Code To Head: from n/a through <= 1.17.

    salubrio Add Code To Head
  • Medium 6.5
    CVE-2025-48312

    WordPress WPAvatar plugin <= 1.9.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 文派翻译（WP Chinese Translation） WPAvatar wpavatar allows Stored XSS.This issue affects WPAvatar: from n/a through <= 1.9.4.

    文派翻译（WP Chinese Translation） WPAvatar
  • Medium 4.3
    CVE-2025-48310

    WordPress Table Editor plugin <= 1.6.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wptableeditor Table Editor wp-table-editor allows Cross Site Request Forgery.This issue affects Table Editor: from n/a through <= 1.6.4.

    wptableeditor Table Editor
  • Medium 5.9
    CVE-2025-48305

    WordPress Goal Tracker for Patreon plugin <= 0.4.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in vikingjs Goal Tracker for Patreon goal-tracker-for-patreon allows Stored XSS.This issue affects Goal Tracker for Patreon: from n/a through <= 0.4.6.

    vikingjs Goal Tracker for Patreon
  • Medium 6.5
    CVE-2025-48110

    WordPress Link View plugin <= 0.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mibuthu Link View link-view allows Stored XSS.This issue affects Link View: from n/a through <= 0.8.0.

    mibuthu Link View
  • Medium 6.5
    CVE-2025-9376

    Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection <= 11.58 - Insufficient Authorization to Unauthenticated Blocklist Bypass

    The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection plugin for WordPress is vulnerable to unauthorized access of data due to an insufficient capability check on the 'stopbadbots_check_wordpress_logged_in_cookie' function in all …

    sminozzi Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Web / CMS
  • Medium 5.1
    CVE-2025-55175

    Reflected XSS in QuickCMS

    QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notifie…

    OpenSolution QuickCMS
  • Medium 5.3
    CVE-2025-54544

    Stored XSS in QuickCMS

    QuickCMS is vulnerable to Stored XSS via aDirFilesDescriptions parameter in files editor functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By defau…

    OpenSolution QuickCMS
  • Medium 5.3
    CVE-2025-54543

    Stored XSS in QuickCMS

    QuickCMS is vulnerable to Stored XSS via sDescriptionMeta parameter in page editor SEO functionality. Malicious attacker with admin privileges can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. By default…

    OpenSolution QuickCMS
  • Medium 6.9
    CVE-2025-54542

    Sending Password in GET Request

    QuickCMS sends password and login via GET Request. This allows a local attacker with access to the victim's browser history to obtain the necessary credentials to log in as the user. The vendor was notified early about this vulnerability, but didn't respond w…

    OpenSolution QuickCMS
  • Medium 6.9
    CVE-2025-54541

    Cross-Site Request Forgery in QuickCMS

    QuickCMS is vulnerable to Cross-Site Request Forgery in page deletion functionality. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request deleting an article. The vendor was notified early about…

    OpenSolution QuickCMS
  • Medium 5.1
    CVE-2025-54540

    Reflected XSS in QuickCMS

    QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified ea…

    OpenSolution QuickCMS
  • Medium 6.5
    CVE-2025-54819

    Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in SS1 Ver.16.0.0.10 and ea…

    DOS SS1 SS1 Cloud
  • Medium 5.3
    CVE-2025-52460

    Files or directories accessible to external parties issue exists in SS1 Ver.16.0.0.10 and earlier (Media version:16.0.0…

    DOS SS1 SS1 Cloud
  • Medium 6.4
    CVE-2025-6255

    Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

    The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes…

    plugincy Dynamic AJAX Product Filters for WooCommerce Web / CMS
  • Medium 6.4
    CVE-2025-8073

    Dynamic AJAX Product Filters for WooCommerce <= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via name Parameter

    The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 1.3.7 due to insufficient input sanitization and output escaping. This makes it p…

    plugincy Dynamic AJAX Product Filters for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-7956

    Ajax Search Lite <= 4.13.1 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler

    The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated …

    WPdreams Ajax Search Lite – Live Search & Filter Web / CMS
  • Medium 6.5
    CVE-2025-8977

    Simple Download Monitor <= 3.9.33 - Simple Download Monitor <= 3.9.33 – Authenticated (Contributor+) SQL Injection via order parameter in Log Export functionality

    The Simple Download Monitor plugin for WordPress is vulnerable to time-based SQL Injection via the order parameter in all versions up to, and including, 3.9.33 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t…

    mra13 Simple Download Monitor Web / CMS
  • Medium 4.9
    CVE-2025-9345 Public exploit

    File Manager, Code Editor, and Backup by Managefy <= 1.4.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Download

    The File Manager, Code Editor, and Backup by Managefy plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.8 via the ajax_downloadfile() function. This makes it possible for authenticated attackers, with Subscriber-le…

    softdiscover File Manager, Code Editor, and Backup by Managefy Web / CMS