Skip to content
OpenAdvisories

Archive

9 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /9 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

348 results · Feed

  • High 8.8
    CVE-2025-48101

    WordPress Constant Contact for WordPress Plugin <= 4.1.1 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in webdevstudios Constant Contact for WordPress allows Object Injection. This issue affects Constant Contact for WordPress: from n/a through 4.1.1.

    webdevstudios Constant Contact for WordPress Web / CMS
  • High 8.1
    CVE-2025-58215

    WordPress Ziston Theme < 1.4.5 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in gavias Ziston ziston allows PHP Local File Inclusion.This issue affects Ziston: from n/a through < 1.4.5.

    gavias Ziston
  • High 7.2
    CVE-2025-49430

    WordPress Ultimate Video Player Plugin <= 10.1 - Server Side Request Forgery (SSRF) Vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in FWDesign Ultimate Video Player fwduvp allows Server Side Request Forgery.This issue affects Ultimate Video Player: from n/a through <= 10.1.

    FWDesign Ultimate Video Player
  • Medium 5.9
    CVE-2025-30875

    WordPress WP Weixin plugin <= 1.3.16 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alexandre Froger WP Weixin wp-weixin allows Stored XSS.This issue affects WP Weixin: from n/a through <= 1.3.16.

    Alexandre Froger WP Weixin
  • Medium 5.3
    CVE-2025-53340

    WordPress Awesome Support plugin <= 6.3.6 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Retrieve Embedded Sensitive Data.This issue affects Awesome Support: from n/a through <= 6.3.6.

    Awesome Support Awesome Support
  • Medium 5.4
    CVE-2025-53291

    WordPress Spreadconnect plugin <= 2.1.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in spoddev2021 Spreadconnect wc-spod.This issue affects Spreadconnect: from n/a through <= 2.1.5.

    spoddev2021 Spreadconnect
  • Medium 5.3
    CVE-2025-53348

    WordPress Kalium Theme <= 3.18.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Laborator Kalium kalium allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kalium: from n/a through <= 3.18.3.

    Laborator Kalium
  • Critical 9.8
    CVE-2025-32486

    WordPress Material Dashboard plugin <= 1.4.6 - Privilege Escalation Vulnerability

    Weak Password Recovery Mechanism for Forgotten Password vulnerability in Hossein Material Dashboard material-dashboard.This issue affects Material Dashboard: from n/a through <= 1.4.6.

    Hossein Material Dashboard
  • High 8.1
    CVE-2025-54709

    WordPress Sala Theme <= 1.1.6 - Local File Inclusion Vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Sala. This issue affects Sala: from n/a through 1.1.6.

    uxper Sala
  • High 7.5
    CVE-2025-32689

    WordPress Download Manager and Payment Form plugin <= 2.8.2 - Price Manipulation vulnerability

    Improper Validation of Specified Quantity in Input vulnerability in Convers Lab WP SmartPay smartpay.This issue affects WP SmartPay: from n/a through <= 2.8.2.

    Convers Lab WP SmartPay
  • Medium 5.4
    CVE-2025-32688

    WordPress Target Video Easy Publish plugin <= 3.8.9 - Arbitrary Code Execution vulnerability

    Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through <= 3.8.9.

    Nebojsa Target Video Easy Publish
  • Medium 4.7
    CVE-2025-39523

    WordPress GoodBarber plugin <= 1.0.26 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in GoodBarber GoodBarber goodbarber.This issue affects GoodBarber: from n/a through <= 1.0.26.

    GoodBarber GoodBarber
  • Medium 6.5
    CVE-2025-39541

    WordPress WP Simple Booking Calendar plugin <= 2.0.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/a through <= 2.0.13.

    Roland Murg WP Simple Booking Calendar
  • Medium 4.3
    CVE-2025-39553

    WordPress Church Admin plugin <= 5.0.9 - Sensitive Data Exposure vulnerability

    Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 5.0.9.

    andy_moyle Church Admin
  • Medium 6.4
    CVE-2025-47437

    WordPress LiteSpeed Cache plugin <= 7.0.1 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 7.0.1.

    LiteSpeed Technologies LiteSpeed Cache
  • Critical 9.3
    CVE-2025-47569

    WordPress WooCommerce Ultimate Gift Card plugin <= 2.9.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPSwings WooCommerce Ultimate Gift Card woocommerce-ultimate-gift-card allows Blind SQL Injection.This issue affects WooCommerce Ultimate Gift Card: from n/a…

    WP Swings WooCommerce Ultimate Gift Card Web / CMS
  • High 7.1
    CVE-2025-47570

    WordPress WooCommerce Photo Reviews plugin <= 1.3.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in villatheme WooCommerce Photo Reviews woocommerce-photo-reviews.This issue affects WooCommerce Photo Reviews: from n/a through <= 1.3.13.

    villatheme WooCommerce Photo Reviews Web / CMS
  • High 7.5
    CVE-2025-47571

    WordPress Super Store Finder plugin < 7.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in highwarden Super Store Finder superstorefinder-wp allows PHP Local File Inclusion.This issue affects Super Store Finder: from n/a through …

    highwarden Super Store Finder
  • Critical 9.0
    CVE-2025-47579

    WordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability

    Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.

    ThemeGoods Photography
  • High 7.5
    CVE-2025-47695

    WordPress Blog Designer PRO plugin <= 3.4.7 - Authenticated Non-Arbitrary Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

    solwin Blog Designer PRO
  • High 7.1
    CVE-2025-47694

    WordPress Blog Designer PRO plugin <= 3.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solwin Blog Designer PRO blog-designer-pro.This issue affects Blog Designer PRO: from n/a through <= 3.4.7.

    solwin Blog Designer PRO
  • Medium 5.3
    CVE-2025-49860

    WordPress Majestic Support plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Majestic Support Majestic Support majestic-support.This issue affects Majestic Support: from n/a through <= 1.1.0.

    Majestic Support Majestic Support
  • Medium 4.3
    CVE-2025-59005

    WordPress Categorify plugin <= 1.0.7.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in frenify Categorify categorify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Categorify: from n/a through <= 1.0.7.5.

    Frenify Categorify
  • High 7.6
    CVE-2025-59008

    WordPress ZIP Code Based Content Protection plugin <= 1.0.0 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PressTigers ZIP Code Based Content Protection zip-code-based-content-protection allows SQL Injection.This issue affects ZIP Code Based Content Protection: fr…

    PressTigers ZIP Code Based Content Protection
  • Medium 5.4
    CVE-2025-55144

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • Medium 6.1
    CVE-2025-55143

    Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivan…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • High 8.8
    CVE-2025-55142

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • High 8.8
    CVE-2025-55141

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • Medium 6.8
    CVE-2025-55139

    SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • High 7.6
    CVE-2025-55148

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • High 8.8
    CVE-2025-55147

    CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • Medium 4.9
    CVE-2025-55146

    An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Iva…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • High —
    GHSA-pfp7-vxgr-83pw

    toodee is vulnerable to Heap Buffer Overflow through its DrainCol Destructor

    An off-by-one error in the `DrainCol::drop` destructor could cause an unsafe memory copy operation to exceed the bounds of the associated vector. The error was related to the size of the data being copied in one of the `ptr::copy` invocations inside the destr…

    toodee crates.io
  • High 8.9
    CVE-2025-55145

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

    ivanti Policy Secure ZTA Gateway Neurons for Secure Access Network devices
  • Medium 5.4
    CVE-2025-8711

    CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…

    ivanti Connect Secure Policy Secure ZTA Gateway Network devices
  • Medium 5.4
    CVE-2025-8712

    Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

    ivanti Policy Secure ZTA Gateway Neurons for Secure Access Network devices
  • High 8.8
    CVE-2025-9872 EPSS 17%

    Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauth…

    ivanti Endpoint Manager Network devices
  • High 8.8
    CVE-2025-9712 EPSS 26%

    Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauth…

    ivanti Endpoint Manager Network devices
  • Critical 9.1
    CVE-2025-10183

    XML External Entity Injection in TecConnect 4.1

    A blind XML External Entity (XXE) injection in the OpenMessaging webservice in TecCom TecConnect 4.1 allows an unauthenticated attacker to exfiltrate arbitrary files to an attacker-controlled server. TecConnect 4.1 is considered end-of-life as of December 202…

    TecCom TecConnect
  • Medium 4.7
    CVE-2025-10107

    TRENDnet TEW-831DR formSysCmd command injection

    A vulnerability has been found in TRENDnet TEW-831DR 1.0 (601.130.1.1410). Impacted is an unknown function of the file /boafrm/formSysCmd. The manipulation of the argument sysHost leads to command injection. The attack is possible to be carried out remotely. …

    Trendnet TEW-831DR