Skip to content
OpenAdvisories

Archive

3 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /3 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

121 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-58620

    WordPress PDF for WPForms Plugin <= 6.2.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Stored XSS.This issue affects PDF for WPForms: from n/a through <= 6.2.1.

    add-ons.org PDF for WPForms
  • Medium 6.5
    CVE-2025-58616

    WordPress Frisbii Pay Plugin <= 1.8.2.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Frisbii Pay: from n/a through <= 1.8.2.1.

    Frisbii Frisbii Pay
  • Medium 4.3
    CVE-2025-58617

    WordPress F4 Media Taxonomies Plugin <= 1.1.4 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F4 Media Taxonomies: from n/a through <= 1.1.4.

    FAKTOR VIER F4 Media Taxonomies
  • Medium 6.5
    CVE-2025-58614

    WordPress Tooltipy Plugin <= 5.5.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.6.

    Jamel.Z Tooltipy
  • Medium 4.4
    CVE-2025-58615

    WordPress WP Bannerize Pro Plugin <= 1.10.0 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in gfazioli WP Bannerize Pro wp-bannerize-pro allows Server Side Request Forgery.This issue affects WP Bannerize Pro: from n/a through <= 1.10.0.

    gfazioli WP Bannerize Pro
  • Medium 6.5
    CVE-2025-58612

    WordPress PropertyHive Plugin <= 2.1.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Property Hive PropertyHive propertyhive allows Stored XSS.This issue affects PropertyHive: from n/a through <= 2.1.5.

    Property Hive PropertyHive
  • Medium 5.3
    CVE-2025-58613

    WordPress Posts Table with Search & Sort Plugin <= 1.4.10 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Table with Search & Sort: from n/a through <= 1.4.10.

    Barn2 Plugins Posts Table with Search & Sort
  • Medium 4.3
    CVE-2025-58611

    WordPress Tickera Plugin <= 3.5.5.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tickera Tickera tickera-event-ticketing-system allows Cross Site Request Forgery.This issue affects Tickera: from n/a through <= 3.5.5.6.

    Tickera Tickera
  • Medium 6.5
    CVE-2025-58609

    WordPress Latest Post Shortcode Plugin <= 14.0.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Iulia Cazan Latest Post Shortcode latest-post-shortcode allows Stored XSS.This issue affects Latest Post Shortcode: from n/a through <= 14.0.3.

    Iulia Cazan Latest Post Shortcode
  • Medium 6.5
    CVE-2025-58610

    WordPress Gallery PhotoBlocks Plugin <= 1.3.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photoblocks-grid-gallery allows Stored XSS.This issue affects Gallery PhotoBlocks: from n/a through <= 1.3.1.

    WP Chill Gallery PhotoBlocks
  • Medium 6.5
    CVE-2025-58607

    WordPress Cookie Notice & Consent Banner for GDPR & CCPA Compliance Plugin <= 1.7.11 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance cookie-notice-and-consent-banner allows Stored XSS.This issue affects Cookie Notice & Con…

    GDPR Info Cookie Notice & Consent Banner for GDPR & CCPA Compliance
  • Medium 5.0
    CVE-2025-58606

    WordPress SaasLauncher Theme <= 1.3.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SaasLauncher: from n/a through <= 1.3.0.

    CozyThemes SaasLauncher
  • Medium 6.5
    CVE-2025-58605

    WordPress WP Delicious Plugin <= 1.8.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.

    WP Delicious WP Delicious
  • Medium 5.3
    CVE-2025-58603

    WordPress Surfer Plugin <= 1.6.4.574 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfer: from n/a through <= 1.6.4.574.

    Surfer Surfer
  • Medium 6.5
    CVE-2025-58602

    WordPress If-So Dynamic Content Personalization Plugin <= 1.9.4 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Stored XSS.This issue affects If-So Dynamic Content Personalization: from n/a throug…

    If-So Dynamic Content If-So Dynamic Content Personalization
  • Medium 5.3
    CVE-2025-58600

    WordPress Paid Member Subscriptions Plugin <= 2.15.9 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.9.

    Cozmoslabs Paid Member Subscriptions
  • Medium 4.3
    CVE-2025-58601

    WordPress Classified Listing Plugin <= 5.0.6 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Classified Listing: from n/a through <= 5.0.6.

    RadiusTheme Classified Listing
  • Medium 6.6
    CVE-2025-58598

    WordPress Klarna Order Management for WooCommerce Plugin <= 1.9.8 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Debugging Code vulnerability in Klarna Klarna Order Management for WooCommerce klarna-order-management-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Klarna Order Management for WooCommerce: …

    Klarna Klarna Order Management for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-58599

    WordPress Order Delivery Date for WooCommerce Plugin <= 4.1.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Delivery Date for WooCommerce: from …

    Tyche Softwares Order Delivery Date for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-58597

    WordPress wpForo Forum Plugin <= 2.4.6 - Insecure Direct Object References (IDOR) Vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Tomdever wpForo Forum wpforo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpForo Forum: from n/a through <= 2.4.6.

    Tomdever wpForo Forum
  • Medium 5.9
    CVE-2025-58596

    WordPress MailOptin Plugin <= 1.2.75.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in properfraction MailOptin mailoptin allows Stored XSS.This issue affects MailOptin: from n/a through <= 1.2.75.0.

    Proper Fraction MailOptin
  • Medium 6.5
    CVE-2025-58593

    WordPress Orbit Fox by ThemeIsle Plugin <= 3.0.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Orbit Fox by ThemeIsle themeisle-companion allows Stored XSS.This issue affects Orbit Fox by ThemeIsle: from n/a through <= 3.0.0.

    themeisle Orbit Fox by ThemeIsle
  • Medium 4.3
    CVE-2025-58594

    WordPress Brizy Plugin <= 2.7.12 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brizy: from n/a through <= 2.7.12.

    themefusecom Brizy
  • Medium 4.8
    CVE-2025-9823

    Reflected XSS in lead:addLeadTags - Quick Add

    SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or es…

    Mautic Mautic mautic/core Packagist
  • Medium 5.9
    CVE-2025-9824

    User Enumeration via Response Timing

    ImpactThe attacker can validate if a user exists by checking the time login returns. This timing difference can be used to enumerate valid usernames, after which an attacker could attempt brute force attacks. PatchesThis vulnerability has been patched, implem…

    Mautic Mautic mautic/core Packagist
  • Medium 5.5
    CVE-2025-9822

    Secret data extraction via elfinder

    SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have access to certain parameters, such as database credentials, ca…

    Mautic Mautic mautic/core Packagist
  • Medium 4.7
    CVE-2025-0878

    XSS in Akinsoft's LimonDesk

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft LimonDesk allows Cross-Site Scripting (XSS). This issue affects LimonDesk: from s1.02.14 before v1.02.17.

    Akinsoft LimonDesk
  • Medium 4.3
    CVE-2024-13066

    iFrame Injection in Akinsoft's LimonDesk

    Improper Restriction of Rendered UI Layers or Frames vulnerability in Akinsoft LimonDesk allows iFrame Overlay, CAPEC - 103 - Clickjacking. This issue affects LimonDesk: from s1.02.14 before v1.02.17.

    Akinsoft LimonDesk
  • Medium 4.3
    CVE-2025-3701

    WordPress Malcure Malware Scanner plugin <= 16.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Malcure Malware Scanner: from n/a through <= 16.8.

    Malcure Web Security Malcure Malware Scanner
  • Medium 5.9
    CVE-2025-9901

    Libsoup: improper handling of http vary header in libsoup caching

    A flaw was found in libsoup’s caching mechanism, SoupCache, where the HTTP Vary header is ignored when evaluating cached responses. This header ensures that responses vary appropriately based on request headers such as language or authentication. Without this…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 6.3
    CVE-2024-13065

    Business Logic Error in Akinsoft's MyRezzta

    Improper Enforcement of Behavioral Workflow, Uncontrolled Resource Consumption vulnerability in Akinsoft MyRezzta allows Input Data Manipulation, CAPEC - 125 - Flooding. This issue affects MyRezzta: from s2.02.02 before v2.05.01.

    Akinsoft MyRezzta
  • Medium 4.3
    CVE-2024-13064

    XSS in Akinsoft's MyRezzta

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Akinsoft MyRezzta allows Cross-Site Scripting (XSS). This issue affects MyRezzta: from s2.02.02 before v2.05.01.

    Akinsoft MyRezzta
  • Medium 6.8
    CVE-2024-13063

    IDOR in Akinsoft's MyRezzta

    Authorization Bypass Through User-Controlled Key vulnerability in Akinsoft MyRezzta allows Forceful Browsing. This issue affects MyRezzta: from s2.02.02 before v2.05.01.

    Akinsoft MyRezzta
  • Medium 4.3
    CVE-2025-9219

    Post SMTP <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Option Update

    The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on …

    Saad Iqbal Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App Web / CMS
  • Medium 5.3
    CVE-2025-58210

    WordPress Makeaholic Theme <= 1.8.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Makeaholic: from n/a through <= 1.8.5.

    ThemeMove Makeaholic
  • Medium 6.4
    CVE-2025-9378

    Vayu Blocks <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Block Attributes

    The Vayu Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple attributes in the Lottie block in all versions up to, and including, 1.3.9 due to insufficient input sanitization and output …

    ThemeHunk Vayu Blocks – Website Builder for the Block Editor Web / CMS
  • Medium 6.2
    CVE-2025-21041

    Insecure Storage of Sensitive Information in Secure Folder prior to Android 16 allows local attackers to access sensiti…

    Samsung Mobile Secure Folder
  • Medium 5.1
    CVE-2025-21040

    Improper verification of intent by ExternalBroadcastReceiver in S Assistant prior to version 9.3.2 allows local attacke…

    Samsung Mobile S Assistant
  • Medium 5.1
    CVE-2025-21039

    Improper verification of intent by SystemExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows loca…

    Samsung Mobile S Assistant
  • Medium 5.1
    CVE-2025-21038

    Improper verification of intent by SamsungExceptionalBroadcastReceiver in S Assistant prior to version 9.3.2 allows loc…

    Samsung Mobile S Assistant