Skip to content
OpenAdvisories

Archive

August 2025

Vulnerabilities first published in this month (UTC), newest first.

← July 2025 2025 / August September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

3,650 results · Feed

  • High 8.1
    CVE-2025-49438

    WordPress Simple Login Log plugin <= 1.1.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Max Chirkov Simple Login Log allows Object Injection. This issue affects Simple Login Log: from n/a through 1.1.3.

    Max Chirkov Simple Login Log
  • High 8.1
    CVE-2025-49436

    WordPress Anotte theme <= 1.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Anotte anotte-wp allows PHP Local File Inclusion.This issue affects Anotte: from n/a through <= 1.8.

    CocoBasic Anotte
  • High 8.1
    CVE-2025-49889

    WordPress Edge CPT plugin <= 1.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT edge-cpt allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through <= 1.4.

    Edge-Themes Edge CPT Browsers
  • Critical 9.8
    CVE-2025-49890

    WordPress Organic Beauty Theme <= 1.4.6 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeREX Organic Beauty organic-beauty allows Object Injection.This issue affects Organic Beauty: from n/a through <= 1.4.6.

    ThemeREX Organic Beauty
  • High 8.5
    CVE-2025-49891

    WordPress Uxper Booking Plugin <= 1.3.3 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in uxper Uxper Booking uxper-booking allows Blind SQL Injection.This issue affects Uxper Booking: from n/a through <= 1.3.3.

    uxper Uxper Booking
  • High 8.1
    CVE-2025-49892

    WordPress Uxper Booking Plugin <= 1.3.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Uxper Booking uxper-booking allows PHP Local File Inclusion.This issue affects Uxper Booking: from n/a through <= 1.3.3.

    uxper Uxper Booking
  • High 8.1
    CVE-2025-49894

    WordPress Nuss Theme <= 1.3.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Nuss nuss allows PHP Local File Inclusion.This issue affects Nuss: from n/a through <= 1.3.3.

    uxper Nuss
  • High 7.1
    CVE-2025-49893

    WordPress Nuss Theme <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Nuss nuss allows Reflected XSS.This issue affects Nuss: from n/a through <= 1.3.3.

    uxper Nuss
  • High 8.8
    CVE-2025-48142

    WordPress Bookify <= 1.0.9 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in Saad Iqbal Bookify bookify allows Privilege Escalation.This issue affects Bookify: from n/a through <= 1.0.9.

    Saad Iqbal Bookify
  • Medium 5.3
    CVE-2025-49896

    WordPress WP Discord Post Plus – Supports Unlimited Channels plugin <= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wptasker WP Discord Post Plus – Supports Unlimited Channels allows Cross Site Request Forgery. This issue affects WP Discord Post Plus – Supports Unlimited Channels: from n/a through 1.0.2.

    wptasker WP Discord Post Plus – Supports Unlimited Channels
  • Critical 10.0
    CVE-2025-48148 Public exploit EPSS 18%

    WordPress StoreKeeper for WooCommerce Plugin <= 14.4.4 - Arbitrary File Upload Vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. StoreKeeper for WooCommerce storekeeper-for-woocommerce allows Using Malicious Files.This issue affects StoreKeeper for WooCommerce: from n/a through <= 14.4.4.

    StoreKeeper StoreKeeper for WooCommerce Web / CMS
  • High 8.1
    CVE-2025-48149

    WordPress Cook&Meal <= 1.2.3 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Cook&Meal cookandmeal allows PHP Local File Inclusion.This issue affects Cook&Meal: from n/a through <= 1.2.3.

    dedalx Cook&Meal
  • High 7.1
    CVE-2025-48151

    WordPress CM Map Locations <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM Map Locations cm-map-locations allows Reflected XSS.This issue affects CM Map Locations: from n/a through <= 2.1.6.

    CreativeMindsSolutions CM Map Locations
  • High 7.1
    CVE-2025-48154

    WordPress Multimedia Playlist Slider Addon for WPBakery Page Builder Plugin <= 2.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder lbg_vp_youtube_vimeo_addon_visual_composer allows Reflected XSS.This issue affects Mu…

    LambertGroup Multimedia Playlist Slider Addon for WPBakery Page Builder
  • High 7.1
    CVE-2025-48152

    WordPress Rentsyst Plugin <= 2.0.100 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dimafreund Rentsyst rentsyst allows Reflected XSS.This issue affects Rentsyst: from n/a through <= 2.0.100.

    DimaFreund Rentsyst
  • High 8.6
    CVE-2025-48158

    WordPress BuddyPress XProfile Custom Image Field Plugin <= 3.0.1 - Arbitrary File Deletion Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Alex Githatu BuddyPress XProfile Custom Image Field buddypress-xprofile-image-field allows Path Traversal.This issue affects BuddyPress XProfile Custom Image Field…

    Alex Githatu BuddyPress XProfile Custom Image Field
  • High 8.1
    CVE-2025-48157 Scanner template

    WordPress Formality <= 1.5.9 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Michele Giorgi Formality formality allows PHP Local File Inclusion.This issue affects Formality: from n/a through <= 1.5.9.

    Michele Giorgi Formality
  • High 7.1
    CVE-2025-48159

    WordPress Youtube Vimeo Video Player and Slider WP Plugin <= 3.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Youtube Vimeo Video Player and Slider WP Plugin video-player-youtube-vimeo allows Reflected XSS.This issue affects Youtube Vimeo Video Player an…

    LambertGroup Youtube Vimeo Video Player and Slider WP Plugin
  • High 7.1
    CVE-2025-48162

    WordPress Simple Business Directory Pro <= 15.5.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Business Directory Pro simple-business-directory-pro allows Reflected XSS.This issue affects Simple Business Directory Pro: from n/a thro…

    Quantum Cloud Simple Business Directory Pro
  • High 8.1
    CVE-2025-48160

    WordPress Caliris <= 1.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CocoBasic Caliris caliris-wp allows PHP Local File Inclusion.This issue affects Caliris: from n/a through <= 1.5.

    CocoBasic Caliris
  • High 7.1
    CVE-2025-48163

    WordPress SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support <= 3.5.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support lbg-audio8-html5-radio-ads allows Reflected XSS.This issue affects SHOUT - H…

    LambertGroup SHOUT - HTML5 Radio Player With Ads - ShoutCast and IceCast Support
  • High 8.8
    CVE-2025-48164

    WordPress SureDash <= 1.0.3 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in Brainstorm Force SureDash suredash allows Privilege Escalation.This issue affects SureDash: from n/a through <= 1.0.3.

    Brainstorm Force SureDash
  • High 8.8
    CVE-2025-48165

    WordPress DELUCKS SEO Plugin <= 2.6.0 - Privilege Escalation Vulnerability

    Incorrect Privilege Assignment vulnerability in DELUCKS DELUCKS SEO delucks-seo allows Privilege Escalation.This issue affects DELUCKS SEO: from n/a through <= 2.6.0.

    delucks DELUCKS SEO
  • High 7.1
    CVE-2025-48168

    WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Apollo - Sticky Full Width HTML5 Audio Player lbg-audio5-html5-shoutcast-sticky allows Reflected XSS.This issue affects Apollo - Sticky Full Wid…

    LambertGroup Apollo - Sticky Full Width HTML5 Audio Player
  • High 7.1
    CVE-2025-48170

    WordPress Universal Video Player - Addon for WPBakery Page Builder <= 3.2.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Universal Video Player - Addon for WPBakery Page Builder lbg-universal-video-player-addon-visual-composer allows Reflected XSS.This issue affect…

    LambertGroup Universal Video Player - Addon for WPBakery Page Builder
  • Critical 9.9
    CVE-2025-48169

    WordPress Code Engine Plugin <= 0.3.3 - Remote Code Execution (RCE) Vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Jordy Meow Code Engine code-engine allows Remote Code Inclusion.This issue affects Code Engine: from n/a through <= 0.3.3.

    Jordy Meow Code Engine
  • High 8.1
    CVE-2025-48171

    WordPress Cena Store <= 2.11.26 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in thembay Cena Store cena allows PHP Local File Inclusion.This issue affects Cena Store: from n/a through <= 2.11.26.

    thembay Cena Store
  • High 7.1
    CVE-2025-48296

    WordPress UpStore <= 1.7.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup UpStore upstore allows Reflected XSS.This issue affects UpStore: from n/a through <= 1.7.0.

    skygroup UpStore
  • High 7.1
    CVE-2025-48297

    WordPress Simple Link Directory < 14.8.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directory allows Reflected XSS.This issue affects Simple Link Directory: from n/a through < 14.8.1.

    Quantum Cloud Simple Link Directory
  • High 7.5
    CVE-2025-48302

    WordPress FundEngine Plugin <= 1.7.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Roxnor FundEngine wp-fundraising-donation allows PHP Local File Inclusion.This issue affects FundEngine: from n/a through <= 1.7.4.

    roxnor FundEngine
  • High 7.5
    CVE-2025-48298

    WordPress SEOPress for MainWP <= 1.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Benjamin Denis SEOPress for MainWP seopress-for-mainwp allows PHP Local File Inclusion.This issue affects SEOPress for MainWP: from n/a th…

    Benjamin Denis SEOPress for MainWP
  • Medium 6.5
    CVE-2025-53195

    WordPress JetEngine plugin <= 3.7.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • High 8.5
    CVE-2025-53194

    WordPress JetEngine <= 3.7.0 - Remote Code Execution (RCE) Vulnerability

    Deserialization of Untrusted Data vulnerability in Crocoblock JetEngine jet-engine allows Code Injection.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-53196

    WordPress JetEngine <= 3.7.0 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Crocoblock JetEngine jet-engine allows Retrieve Embedded Sensitive Data.This issue affects JetEngine: from n/a through <= 3.7.0.

    Crocoblock JetEngine
  • High 8.1
    CVE-2025-53198

    WordPress Houzez theme <= 4.0.4 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in favethemes Houzez houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a through <= 4.0.4.

    Fave Themes Houzez
  • High 8.1
    CVE-2025-53204

    WordPress eventlist plugin <= 1.9.2 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ovatheme eventlist eventlist allows PHP Local File Inclusion.This issue affects eventlist: from n/a through <= 1.9.2.

    Ovatheme eventlist
  • High 7.1
    CVE-2025-53201

    WordPress Jobmonster theme <= 4.7.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Jobmonster noo-jobmonster allows Reflected XSS.This issue affects Jobmonster: from n/a through <= 4.7.8.

    NooTheme Jobmonster
  • High 8.1
    CVE-2025-53207

    WordPress WP Travel Gutenberg Blocks plugin <= 3.9.0 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Travel WP Travel Gutenberg Blocks wp-travel-blocks allows PHP Local File Inclusion.This issue affects WP Travel Gutenberg Blocks: from …

    WP Travel WP Travel Gutenberg Blocks
  • High 7.1
    CVE-2025-53205

    WordPress Radio Player Shoutcast & Icecast <= 4.4.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Radio Player Shoutcast & Icecast lbg-audio4-html5-shoutcast allows Reflected XSS.This issue affects Radio Player Shoutcast & Icecast: from n/a t…

    LambertGroup Radio Player Shoutcast & Icecast
  • High 7.5
    CVE-2025-53210

    WordPress ZoloBlocks Plugin <= 2.3.2 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in bdthemes ZoloBlocks zoloblocks allows PHP Local File Inclusion.This issue affects ZoloBlocks: from n/a through <= 2.3.2.

    bdthemes ZoloBlocks