Skip to content
OpenAdvisories

Archive

5 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /5 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

108 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-58802

    WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Site Request Forgery.This issue affects TrustMate.io – WooCommerce integration: from n/a through <= 1.…

    michalzagdan TrustMate.io – WooCommerce integration Web / CMS
  • Medium 5.4
    CVE-2025-58801

    WordPress Responder Plugin <= 4.3.8 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in KCS Responder responder allows Cross Site Request Forgery.This issue affects Responder: from n/a through <= 4.3.8.

    KCS Responder
  • Medium 4.3
    CVE-2025-58800

    WordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Email Template: from n/a through <= 2.8.5.

    Steve Truman WP Email Template
  • Medium 4.3
    CVE-2025-58799

    WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross Site Request Forgery.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through…

    themelocation Custom WooCommerce Checkout Fields Editor Web / CMS
  • Medium 4.3
    CVE-2025-58798

    WordPress BCM Duplicate Menu plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Bjorn Manintveld BCM Duplicate Menu bcm-duplicate-menu allows Cross Site Request Forgery.This issue affects BCM Duplicate Menu: from n/a through <= 1.1.3.

    Bjorn Manintveld BCM Duplicate Menu
  • Medium 6.5
    CVE-2025-58796

    WordPress Elementor Element Condition Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition ele-conditions allows Stored XSS.This issue affects Elementor Element Condition: from n/a through <= 1.0.5.

    dudaster Elementor Element Condition
  • Medium 5.3
    CVE-2025-58797

    WordPress Ninja Charts plugin <= 3.3.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through <= 3.3.5.

    Mahmudul Hasan Arif Ninja Charts
  • Medium 4.3
    CVE-2025-58795

    WordPress Payoneer Checkout Plugin <= 3.4.0 - Content Spoofing Vulnerability

    Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.

    Payoneer Checkout Payoneer Checkout
  • Medium 4.3
    CVE-2025-58794

    WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.

    rainafarai Notification for Telegram
  • Medium 6.5
    CVE-2025-58793

    WordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through <= 1.7.

    wpbean WPB Elementor Addons
  • Medium 4.3
    CVE-2025-58792

    WordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a through <= 2.0.6.2.

    WPKube Authors List
  • Medium 5.9
    CVE-2025-58791

    WordPress SEO Auto Linker Plugin <= 1.5.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arjan Olsder SEO Auto Linker wpa-seo-auto-linker allows Stored XSS.This issue affects SEO Auto Linker: from n/a through <= 1.5.3.

    Arjan Olsder SEO Auto Linker
  • Medium 6.5
    CVE-2025-58790

    WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.

    WPKube Kiwi
  • Medium 6.5
    CVE-2025-58787

    WordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Popup themify-popup allows Stored XSS.This issue affects Themify Popup: from n/a through <= 1.4.2.

    themifyme Themify Popup
  • Medium 6.5
    CVE-2025-58786

    WordPress Ibtana – Ecommerce Product Addons plugin <= 0.4.7.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons allows DOM-Based XSS.This issue affects Ibtana – Ecommerce Product Addons: from n…

    VW THEMES Ibtana – Ecommerce Product Addons
  • Medium 5.4
    CVE-2025-58785

    WordPress Ray Enterprise Translation plugin <= 1.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.2.

    Jiro Sasamoto Ray Enterprise Translation
  • Medium 6.5
    CVE-2025-58784

    WordPress ARI Fancy Lightbox Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through <= 1.4.0.

    ARI Soft ARI Fancy Lightbox
  • Medium 4.3
    CVE-2025-58783

    WordPress Gutentor plugin <= 3.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutentor: from n/a through <= 3.5.5.

    gutentor Gutentor
  • Medium 5.4
    CVE-2025-8695

    Reflected XSS in Netcad Software's NetGIS Server

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad NetGIS Server allows Reflected XSS. This issue affects NetGIS Server: from 5.2.4 through 22.08.2025.

    Netcad Software NetGIS Server
  • Medium 5.1
    CVE-2025-58313

    Race condition vulnerability in the device standby module. Impact: Successful exploitation of this vulnerability may ca…

    Huawei HarmonyOS Network devices
  • Medium 6.8
    CVE-2025-58276

    Permission verification vulnerability in the home screen module Impact: Successful exploitation of this vulnerability m…

    Huawei HarmonyOS EMUI Network devices
  • Medium 4.7
    CVE-2025-48395

    An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing th…

    Eaton NMC G2
  • Medium 4.3
    CVE-2025-8944

    OceanWP < 4.1.2 - Subscriber+ Limited Option Update

    The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any authenticated users, such as subscriber to update the darkMod` setting.

    Web / CMS
  • Medium 6.7
    CVE-2025-58400

    RATOC RAID Monitoring Manager for Windows provided by RATOC Systems, Inc. registers a Windows service with an unquoted …

    RATOC Systems RATOC RAID Monitoring Manager for Windows Windows
  • Medium 4.3
    CVE-2025-41408

    Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14…

    LY "Yahoo! Shopping" App for Android Android
  • Medium 6.8
    CVE-2025-58401

    Obsidian GitHub Copilot Plugin versions prior to 1.1.7 store Github API token in cleartext form. As a result, an attack…

    Pierre-Adrien Vasseur Obsidian GitHub Copilot Plugin
  • Medium 6.4
    CVE-2025-8684

    Flatsome <= 3.20.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Flatsome Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the theme's shortcodes in all versions up to, and including, 3.20.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl…

    UX-themes Flatsome Web / CMS
  • Medium 6.5
    CVE-2025-7445

    Kubernetes secrets-store-sync-controller discloses service account tokens in logs

    Kubernetes secrets-store-sync-controller in versions before 0.0.2 discloses service account tokens in logs.

    Kubernetes secrets-store-sync-controller sigs.k8s.io/secrets-store-sync-controller Go