Skip to content
OpenAdvisories

Archive

28 August 2025

Vulnerabilities first published on this day (UTC), newest first.

← July 2025 2025 / August /28 September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

99 results · Clear filters · Feed

  • Medium 6.1
    CVE-2024-9648

    WP ULike Pro <= 1.9.3 - Unauthenticated Limited Arbitrary File Upload

    The WP ULike Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the WP_Ulike_Pro_File_Uploader class in all versions up to, and including, 1.9.3. This makes it possible for unauthenticated attackers to…

    WP Ulike WP ULike Pro Web / CMS
  • Medium 6.4
    CVE-2025-8603

    Unlimited Elements For Elementor <= 1.5.148 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 1.5.148 due to insufficient input sanitization and output escaping. This makes it possible for aut…

    unitecms Unlimited Elements For Elementor Web / CMS
  • Medium 6.4
    CVE-2025-9346

    Booking Calendar <= 10.14.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 10.14.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, w…

    wpdevelop Booking Calendar Web / CMS
  • Medium 4.3
    CVE-2025-0951

    LiquidThemes Themes <= Various Versions - Missing Authorization to Authenticated (Subscriber+) All Plugins Deactivated

    Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscr…

    LiquidThemes AI Hub - Startup & Technology WordPress Theme ArcHub - Architecture and Interior Design WordPress Theme Hub - Responsive Multi-Purpose WordPress Theme Web / CMS
  • Medium 6.1
    CVE-2025-8897

    Beaver Builder Plugin (Lite Version) <= 2.9.2.1 - Reflected Cross-Site Scripting

    The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘'fl_builder' parameter in all versions up to, and including, 2.9.2.1 due to insufficient input sanitization and output escaping. This mak…

    Beaver Builder Beaver Builder Page Builder – Drag and Drop Website Builder Web / CMS
  • Medium 6.4
    CVE-2025-9344

    UsersWP <= 1.2.42 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'uwp_profile' and 'uwp_profile_header' shortcodes in all versions up to, a…

    stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP Web / CMS
  • Medium 5.4
    CVE-2025-9352

    Pronamic Google Maps <= 2.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Pronamic Google Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the description field in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticat…

    pronamic Pronamic Google Maps Web / CMS
  • Medium 6.5
    CVE-2025-29364

    spimsimulator spim v9.1.24 and before is vulnerable to Buffer Overflow in the READ_SYSCALL and WRITE_SYSCALL system cal…

    spim spim Debian Ubuntu
  • Medium 5.3
    CVE-2025-57218

    Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the security_5g parame…

  • Medium 5.3
    CVE-2025-57217

    Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 was discovered to contain a stack overflow via the Password parameter…

  • Medium 5.3
    CVE-2025-57220

    An input validation flaw in the 'ate' service of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 to escalate privileg…

  • Medium 5.3
    CVE-2025-57219

    Incorrect access control in the endpoint /goform/ate of Tenda AC10 v4.0 firmware v16.03.10.09_multi_TDE01 allows attack…

  • Medium 5.3
    CVE-2025-52054

    An issue was discovered in Tenda AC8 v4.0 AC1200 Dual-band Gigabit Wireless Router AC8v4.0 Firmware 16.03.33.05. The ro…

  • Medium 6.5
    CVE-2025-51972

    A SQL Injection vulnerability exists in the login.php of PuneethReddyHC Online Shopping System Advanced 1.0 due to impr…

  • Medium 6.1
    CVE-2025-51967

    A Reflected Cross-site Scripting (XSS) vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Mana…

  • Medium 6.5
    CVE-2025-51968

    A SQL Injection vulnerability exists in the action.php file of PuneethReddyHC Online Shopping System Advanced 1.0. The …

  • Medium 6.5
    CVE-2025-51969

    A SQL Injection vulnerability exists in the product.php page of PuneethReddyHC Online Shopping System Advanced 1.0. Thi…

  • Medium 5.4
    CVE-2025-51971

    A reflected Cross-Site Scripting (XSS) vulnerability exists in register.php of PuneethReddyHC Online Shopping System Ad…

  • Medium 6.1
    CVE-2025-56236

    FormCms avatar upload feature has a stored cross-site scripting (XSS) vulnerability

    FormCms v0.5.5 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload feature. Authenticated users can upload .html files containing malicious JavaScript, which are accessible via a public URL. When a privileged user accesses the file…

    FormCMS NuGet