Skip to content
OpenAdvisories

Archive

26 September 2025

Vulnerabilities first published on this day (UTC), newest first.

← August 2025 2025 / September /26 October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

130 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-60152

    WordPress Subscribe To Unlock Plugin <= 1.1.5 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe To Unlock: from n/a through <= 1.1.5.

    WP Shuffle Subscribe To Unlock
  • Medium 5.9
    CVE-2025-60149

    WordPress Notely plugin <= 1.8.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rocket Apps Notely notely allows Stored XSS.This issue affects Notely: from n/a through <= 1.8.0.

    Rocket Apps Notely
  • Medium 4.3
    CVE-2025-60148

    WordPress Subscribe to Download plugin <= 2.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpshuffle Subscribe to Download subscribe-to-download allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe to Download: from n/a through <= 2.0.9.

    WP Shuffle Subscribe to Download
  • Medium 6.5
    CVE-2025-60147

    WordPress HT Feed Plugin <= 1.3.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HT Plugins HT Feed ht-instagram allows Stored XSS.This issue affects HT Feed: from n/a through <= 1.3.0.

    HT Plugins HT Feed
  • Medium 5.9
    CVE-2025-60146

    WordPress Map Categories to Pages Plugin <= 1.3.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amit Verma Map Categories to Pages map-categories-to-pages allows Stored XSS.This issue affects Map Categories to Pages: from n/a through <= 1.3.2.

    Amit Verma Map Categories to Pages
  • Medium 4.3
    CVE-2025-60145

    WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Cross Site Request Forgery.This issue affects Lenix scss compiler: from n/a through <= 1.2.

    yonifre Lenix scss compiler
  • Medium 4.3
    CVE-2025-60143

    WordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerability

    Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through <= 2.9.69.

    netgsm Netgsm
  • Medium 5.9
    CVE-2025-60144

    WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Stored XSS.This issue affects Lenix scss compiler: from n/a through <= 1.2.

    yonifre Lenix scss compiler
  • Medium 6.5
    CVE-2025-60142

    WordPress Simple Meta Tags Plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DaganLev Simple Meta Tags simple-meta-tags allows DOM-Based XSS.This issue affects Simple Meta Tags: from n/a through <= 1.5.

    DaganLev Simple Meta Tags
  • Medium 5.9
    CVE-2025-60141

    WordPress The Tribal Plugin <= 1.3.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thetechtribe The Tribal the-tech-tribe allows Stored XSS.This issue affects The Tribal: from n/a through <= 1.3.3.

    thetechtribe The Tribal
  • Medium 5.3
    CVE-2025-60140

    WordPress The Tribal Plugin <= 1.3.3 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in thetechtribe The Tribal the-tech-tribe allows Retrieve Embedded Sensitive Data.This issue affects The Tribal: from n/a through <= 1.3.3.

    thetechtribe The Tribal
  • Medium 4.3
    CVE-2025-60139

    WordPress Sendle Shipping plugin <= 6.02 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Joovii Sendle Shipping official-sendle-shipping-method allows Cross Site Request Forgery.This issue affects Sendle Shipping: from n/a through <= 6.02.

    Joovii Sendle Shipping
  • Medium 6.5
    CVE-2025-60138

    WordPress SKT Blocks plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Blocks skt-blocks allows Stored XSS.This issue affects SKT Blocks: from n/a through <= 2.6.

    sonalsinha21 SKT Blocks
  • Medium 4.3
    CVE-2025-60137

    WordPress Post Featured Video Plugin <= 1.7 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Galaxy Weblinks Post Featured Video post-featured-video allows Cross Site Request Forgery.This issue affects Post Featured Video: from n/a through <= 1.7.

    Galaxy Weblinks Post Featured Video
  • Medium 5.9
    CVE-2025-60133

    WordPress PE Easy Slider Plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DJ-Extensions.com PE Easy Slider pe-easy-slider allows Stored XSS.This issue affects PE Easy Slider: from n/a through <= 1.1.0.

    dj-extensions.com PE Easy Slider
  • Medium 5.9
    CVE-2025-60136

    WordPress User Notes plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cartpauj User Notes user-notes allows Stored XSS.This issue affects User Notes: from n/a through <= 1.0.2.

    cartpauj User Notes
  • Medium 5.3
    CVE-2025-60129

    WordPress Yext Plugin <= 1.1.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Yext Yext yext allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Yext: from n/a through <= 1.1.3.

    Yext Yext
  • Medium 5.3
    CVE-2025-60130

    WordPress WEDOS Global Plugin <= 1.2.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in wedos.com WEDOS Global wgpwpp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WEDOS Global: from n/a through <= 1.2.2.

    wedos.com WEDOS Global
  • Medium 4.3
    CVE-2025-60128

    WordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through <= 1.1.3.

    WP Delicious Delisho
  • Medium 5.4
    CVE-2025-60127

    WordPress CopySafe Web Protection plugin <= 5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ArtistScope CopySafe Web Protection wp-copysafe-web allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CopySafe Web Protection: from n/a through <= 5.1.

    ArtistScope CopySafe Web Protection
  • Medium 5.3
    CVE-2025-60125

    WordPress FoodBook Plugin <= 4.7.6 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in themelooks FoodBook foodbook allows Retrieve Embedded Sensitive Data.This issue affects FoodBook: from n/a through <= 4.7.6.

    themelooks FoodBook
  • Medium 6.5
    CVE-2025-60124

    WordPress Simple Colorbox Plugin <= 1.6.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Hellyer Simple Colorbox simple-colorbox allows Stored XSS.This issue affects Simple Colorbox: from n/a through <= 1.6.1.

    Ryan Hellyer Simple Colorbox
  • Medium 4.3
    CVE-2025-60123

    WordPress HivePress Claim Listings plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.3.

    HivePress HivePress Claim Listings
  • Medium 4.3
    CVE-2025-60122

    WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HivePress Claim Listings: from n/a through <= 1.1.4.

    HivePress HivePress Claim Listings
  • Medium 5.3
    CVE-2025-60121

    WordPress WooEvents plugin <= 4.1.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ex-Themes WooEvents woo-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooEvents: from n/a through <= 4.1.7.

    Ex-Themes WooEvents
  • Medium 5.3
    CVE-2025-60119

    WordPress CoSchedule Plugin <= 3.3.11 - Sensitive Data Exposure Vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Retrieve Embedded Sensitive Data.This issue affects CoSchedule: from n/a through <= 3.3.11.

    CoSchedule CoSchedule
  • Medium 5.3
    CVE-2025-60120

    WordPress WP Directory Kit plugin <= 1.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDirectoryKit WP Directory Kit wpdirectorykit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through <= 1.4.0.

    Wp Directory Kit WP Directory Kit
  • Medium 4.3
    CVE-2025-60117

    WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through <= 1.0.100.

    TangibleWP Vehica Core
  • Medium 5.4
    CVE-2025-60116

    WordPress Grand Conference Theme Custom Post Type plugin < 2.6.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeGoods Grand Conference Theme Custom Post Type grandconference-custom-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grand Conference Theme Custom Post Type: from n/a …

    ThemeGoods Grand Conference Theme Custom Post Type
  • Medium 4.3
    CVE-2025-60115

    WordPress Instapage plugin plugin <= 3.7.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in instapagedev Instapage Plugin instapage allows Cross Site Request Forgery.This issue affects Instapage Plugin: from n/a through <= 3.7.0.

    instapagedev Instapage Plugin
  • Medium 6.6
    CVE-2025-60114

    WordPress YayCurrency plugin <= 3.3.1 - Remote Code Execution (RCE) vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in YayCommerce YayCurrency yaycurrency allows Code Injection.This issue affects YayCurrency: from n/a through <= 3.3.1.

    YayCommerce YayCurrency
  • Medium 4.3
    CVE-2025-60113

    WordPress Groovy Menu Plugin <= 1.4.3 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through <= 1.4.3.

    grooni Groovy Menu
  • Medium 6.5
    CVE-2025-60112

    WordPress aThemes Addons for Elementor Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syed Balkhi aThemes Addons for Elementor athemes-addons-for-elementor-lite allows Stored XSS.This issue affects aThemes Addons for Elementor: from n/a throug…

    Syed Balkhi aThemes Addons for Elementor
  • Medium 4.9
    CVE-2025-60106

    WordPress EmailKit Plugin <= 1.6.0 - Arbitrary Content Deletion Vulnerability

    Missing Authorization vulnerability in Roxnor EmailKit emailkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EmailKit: from n/a through <= 1.6.0.

    roxnor EmailKit
  • Medium 5.9
    CVE-2025-60104

    WordPress Gallery Custom Links Plugin <= 2.2.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jordy Meow Gallery Custom Links gallery-custom-links allows Stored XSS.This issue affects Gallery Custom Links: from n/a through <= 2.2.5.

    Jordy Meow Gallery Custom Links
  • Medium 6.5
    CVE-2025-60105

    WordPress Ditty Plugin <= 3.1.58 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in metaphorcreations Ditty ditty-news-ticker allows Stored XSS.This issue affects Ditty: from n/a through <= 3.1.58.

    Metaphor Creations Ditty
  • Medium 5.4
    CVE-2025-60103

    WordPress ListingPro plugin <= 2.9.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CridioStudio ListingPro listingpro-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ListingPro: from n/a through <= 2.9.8.

    Cridio Studio ListingPro
  • Medium 6.5
    CVE-2025-60099

    WordPress Embed Any Document Plugin <= 2.7.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awsm.in Embed Any Document embed-any-document allows Stored XSS.This issue affects Embed Any Document: from n/a through <= 2.7.7.

    awsmin Embed Any Document
  • Medium 6.5
    CVE-2025-60102

    WordPress WPFront User Role Editor Plugin <= 4.2.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Syam Mohan WPFront User Role Editor wpfront-user-role-editor allows Stored XSS.This issue affects WPFront User Role Editor: from n/a through <= 4.2.3.

    Syam Mohan WPFront User Role Editor
  • Medium 5.3
    CVE-2025-60100

    WordPress XStore theme < 9.6 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in 8theme XStore xstore allows Code Injection.This issue affects XStore: from n/a through < 9.6.

    8theme XStore