Skip to content
OpenAdvisories

Archive

August 2025

Vulnerabilities first published in this month (UTC), newest first.

← July 2025 2025 / August September 2025 →
  1. 1112
  2. 242
  3. 329
  4. 485
  5. 5120
  6. 6217
  7. 791
  8. 876
  9. 941
  10. 1036
  11. 1193
  12. 12355
  13. 13147
  14. 14311
  15. 1593
  16. 1695
  17. 177
  18. 1875
  19. 19174
  20. 20274
  21. 21128
  22. 22169
  23. 2329
  24. 2424
  25. 25124
  26. 26130
  27. 27130
  28. 28192
  29. 29165
  30. 3044
  31. 3142
All Critical High Medium Low Exploited only Public exploit

3,650 results · Feed

  • Medium 6.5
    CVE-2025-53330

    WordPress WP Rentals theme <= 3.16.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpEstate WP Rentals wprentals allows Stored XSS.This issue affects WP Rentals: from n/a through <= 3.16.1.

    WpEstate WP Rentals
  • Medium 4.3
    CVE-2025-53341

    WordPress Stratus theme <= 4.2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Pixel Makers Creative INC. App, SaaS & Software Startup Tech Theme - Stratus allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App, SaaS & Software Startup Tech Theme - Stratus: …

    Pixel Makers Creative App, SaaS & Software Startup Tech Theme - Stratus
  • Medium 6.5
    CVE-2025-53342

    WordPress Modernize Theme <= 3.4.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoodLayers Modernize modernize allows Stored XSS.This issue affects Modernize: from n/a through <= 3.4.0.

    GoodLayers Modernize
  • Medium 4.3
    CVE-2025-53343

    WordPress Modernize Theme <= 3.4.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in GoodLayers Modernize modernize allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Modernize: from n/a through <= 3.4.0.

    GoodLayers Modernize
  • Medium 4.3
    CVE-2025-53347

    WordPress Kalium Theme <= 3.18.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Laborator Kalium kalium allows Cross Site Request Forgery.This issue affects Kalium: from n/a through <= 3.18.3.

    Laborator Kalium
  • High 7.1
    CVE-2025-53575

    WordPress Primer MyData for Woocommerce Plugin <= 4.2.5 - Cross Site Request Forgery (CSRF) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in primersoftware Primer MyData for Woocommerce primer-mydata allows Reflected XSS.This issue affects Primer MyData for Woocommerce: from n/a through <= 4.2.5.

    primersoftware Primer MyData for Woocommerce Web / CMS
  • Medium 5.9
    CVE-2025-53581

    WordPress RSS Feed Pro Plugin <= 1.1.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in artiosmedia RSS Feed Pro rss-feed-pro allows Stored XSS.This issue affects RSS Feed Pro: from n/a through <= 1.1.8.

    Artios Media RSS Feed Pro
  • Medium 6.5
    CVE-2025-53582

    WordPress WordLift Plugin <= 3.54.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WordLift WordLift wordlift allows Stored XSS.This issue affects WordLift: from n/a through <= 3.54.5.

    WordLift Srl WordLift
  • High 8.8
    CVE-2025-53587

    WordPress Findgo Theme <= 1.3.57 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in ApusTheme Findgo findgo allows Cross Site Request Forgery.This issue affects Findgo: from n/a through <= 1.3.57.

    ApusTheme Findgo
  • Medium 6.5
    CVE-2025-54054

    WordPress 12 Step Meeting List Plugin <= 3.18.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AA Web Servant 12 Step Meeting List 12-step-meeting-list allows Stored XSS.This issue affects 12 Step Meeting List: from n/a through <= 3.18.3.

    AA Web Servant 12 Step Meeting List
  • Medium 6.5
    CVE-2025-54708

    WordPress B Blocks Plugin <= 2.0.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks b-blocks allows DOM-Based XSS.This issue affects B Blocks: from n/a through <= 2.0.5.

    bPlugins B Blocks
  • Medium 4.3
    CVE-2025-54712

    WordPress Easy Elementor Addons Plugin <= 2.2.7 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in hashthemes Easy Elementor Addons easy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Elementor Addons: from n/a through <= 2.2.7.

    HashThemes Easy Elementor Addons
  • Medium 4.9
    CVE-2025-54715

    WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.9.0 - Arbitrary File Download Vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Trave…

    Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager
  • Medium 5.4
    CVE-2025-54717

    WordPress WP Membership Plugin <= 1.6.3 - Settings Change Vulnerability

    Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Membership: from n/a through <= 1.6.3.

    e-plugins WP Membership
  • Medium 5.9
    CVE-2025-54727

    WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Stored XSS.This issue affects CM On Demand Search And Replace: …

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 4.3
    CVE-2025-54728

    WordPress CM On Demand Search And Replace Plugin <= 1.5.2 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Cross Site Request Forgery.This issue affects CM On Demand Search And Replace: from n/a through <= 1.5.2.

    CreativeMindsSolutions CM On Demand Search And Replace
  • Medium 5.9
    CVE-2025-54729

    WordPress Webba Booking Plugin <= 6.0.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Stored XSS.This issue affects Webba Booking: from n/a through <= 6.0.5.

    Webba Appointment Booking Webba Booking
  • Medium 5.3
    CVE-2025-54730

    WordPress Embedder for Google Reviews Plugin <= 1.7.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in PARETO Digital Embedder for Google Reviews embedder-for-google-reviews allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Embedder for Google Reviews: from n/a through <= 1.7.3.

    PARETO Digital Embedder for Google Reviews
  • Medium 4.3
    CVE-2025-54732

    WordPress WPDM – Premium Packages Plugin <= 6.0.2 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Shahjada WPDM – Premium Packages wpdm-premium-packages allows Cross Site Request Forgery.This issue affects WPDM – Premium Packages: from n/a through <= 6.0.2.

    Shahjada WPDM – Premium Packages
  • Medium 5.3
    CVE-2025-54736

    WordPress Savoy Theme <= 3.0.8 - Sensitive Data Exposure Vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NordicMade Savoy savoy allows Retrieve Embedded Sensitive Data.This issue affects Savoy: from n/a through <= 3.0.8.

    NordicMade Savoy
  • Medium 5.3
    CVE-2025-54739

    WordPress Nexter Blocks Plugin <= 4.5.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Nexter Blocks: from n/a through <= 4.5.4.

    POSIMYTH Nexter Blocks
  • Medium 6.5
    CVE-2025-54740

    WordPress Print My Blog Plugin <= 3.27.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michael Nelson Print My Blog print-my-blog allows Stored XSS.This issue affects Print My Blog: from n/a through <= 3.27.9.

    Michael Nelson Print My Blog
  • Medium 6.5
    CVE-2025-54746

    WordPress Shortcode Redirect Plugin <= 1.0.02 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj Shortcode Redirect shortcode-redirect allows Stored XSS.This issue affects Shortcode Redirect: from n/a through <= 1.0.02.

    cartpauj Shortcode Redirect
  • Medium 6.5
    CVE-2025-54749

    WordPress JetProductGallery Plugin <= 2.2.0.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductGallery jet-woo-product-gallery allows Stored XSS.This issue affects JetProductGallery: from n/a through <= 2.2.0.2.

    Crocoblock JetProductGallery
  • Medium 6.5
    CVE-2025-54747

    WordPress Templatera Plugin <= 2.3.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbakery Templatera templatera allows DOM-Based XSS.This issue affects Templatera: from n/a through <= 2.3.0.

    wpbakery Templatera
  • High 8.5
    CVE-2025-55708

    WordPress Quiz And Survey Master Plugin <= 10.2.4 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows SQL Injection.This issue affects Quiz And Survey Master: from n/a through <= 10.2.4.

    ExpressTech Systems Quiz And Survey Master
  • Medium 6.5
    CVE-2025-55709

    WordPress Visual Composer Website Builder Plugin < 45.15.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Stored XSS.This issue affects Visual Composer Website Builder: from n/a through < 45.15…

    Visual Composer Visual Composer Website Builder
  • Medium 4.3
    CVE-2025-55710

    WordPress TaxoPress Plugin <= 3.37.2 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Steve Burge TaxoPress simple-tags allows Retrieve Embedded Sensitive Data.This issue affects TaxoPress: from n/a through <= 3.37.2.

    Steve Burge TaxoPress
  • Medium 6.5
    CVE-2025-55711

    WordPress WP Table Builder Plugin <= 2.0.12 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Table Builder WP Table Builder wp-table-builder allows Stored XSS.This issue affects WP Table Builder: from n/a through <= 2.0.12.

    WP Table Builder WP Table Builder
  • Medium 6.5
    CVE-2025-55712

    WordPress The Plus Addons for Elementor Page Builder Lite Plugin <= 6.3.13 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in POSIMYTH The Plus Addons for Elementor Page Builder Lite the-plus-addons-for-elementor-page-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Plus Addons for Elementor…

    POSIMYTH The Plus Addons for Elementor Page Builder Lite
  • Medium 5.9
    CVE-2025-55713

    WordPress Blocksy Theme <= 2.1.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy allows Stored XSS.This issue affects Blocksy: from n/a through <= 2.1.6.

    creativethemeshq Blocksy
  • Medium 6.5
    CVE-2025-55714

    WordPress JetElements For Elementor Plugin <= 2.7.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.9.

    Crocoblock JetElements For Elementor
  • Medium 4.3
    CVE-2025-55716

    WordPress WP Statistics Plugin <= 14.15 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in VeronaLabs WP Statistics wp-statistics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Statistics: from n/a through <= 14.15.

    VeronaLabs WP Statistics
  • Medium 6.7
    CVE-2025-21110

    Dell Data Lakehouse, versions prior to 1.5.0.0, contains an Execution with Unnecessary Privileges vulnerability. A high…

    Dell Data Lakehouse
  • Low 3.7
    CVE-2025-8974

    linlinjava litemall JSON Web Token JwtHelper.java hard-coded credentials

    A vulnerability was determined in linlinjava litemall up to 1.8.0. Affected by this issue is some unknown functionality of the file litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/util/JwtHelper.java of the component JSON Web Token Handler. The manip…

    linlinjava litemall
  • High 7.3
    CVE-2025-8973

    SourceCodester Cashier Queuing System Actions.php sql injection

    A vulnerability has been found in SourceCodester Cashier Queuing System 1.0. Affected is an unknown function of the file /Actions.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit …

    SourceCodester Cashier Queuing System
  • High 7.3
    CVE-2025-8972

    itsourcecode Online Tour and Travel Management System page-login.php sql injection

    A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be initiat…

    itsourcecode Online Tour and Travel Management System
  • Medium 6.5
    CVE-2024-37945

    WordPress WPBITS Addons For Elementor plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpbits WPBITS Addons For Elementor Page Builder wpbits-addons-for-elementor allows Stored XSS.This issue affects WPBITS Addons For Elementor Page Builder: fr…

    wpbits WPBITS Addons For Elementor Page Builder
  • High 7.3
    CVE-2025-8971 Public exploit

    itsourcecode Online Tour and Travel Management System travellers.php sql injection

    A vulnerability was determined in itsourcecode Online Tour and Travel Management System 1.0. This vulnerability affects unknown code of the file /admin/operations/travellers.php. The manipulation of the argument val-username leads to sql injection. The attack…

    itsourcecode Online Tour and Travel Management System
  • High 7.3
    CVE-2025-8970

    itsourcecode Online Tour and Travel Management System booking.php sql injection

    A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/booking.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack r…

    itsourcecode Online Tour and Travel Management System