Skip to content
OpenAdvisories

Archive

September 2025

Vulnerabilities first published in this month (UTC), newest first.

← August 2025 2025 / September October 2025 →
  1. 184
  2. 2140
  3. 3194
  4. 4272
  5. 5233
  6. 660
  7. 719
  8. 899
  9. 9348
  10. 1099
  11. 11155
  12. 1292
  13. 1315
  14. 1437
  15. 15412
  16. 16231
  17. 17219
  18. 18199
  19. 19120
  20. 2015
  21. 2117
  22. 22415
  23. 23126
  24. 24125
  25. 25108
  26. 26201
  27. 2753
  28. 2836
  29. 29120
  30. 30103
All Critical High Medium Low Exploited only Public exploit

2,069 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-58834

    WordPress short.io Plugin <= 2.4.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gugu short.io wp-shortcm allows DOM-Based XSS.This issue affects short.io: from n/a through <= 2.4.2.

    gugu short.io
  • Medium 5.9
    CVE-2025-58832

    WordPress Search by Google Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Search by Google search-google allows Stored XSS.This issue affects Search by Google: from n/a through <= 1.9.

    webvitaly Search by Google
  • Medium 6.5
    CVE-2025-58830

    WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Stored XSS.This issue affects Parallax Scrolling Enllax.js: from n/a through <= …

    snagysandor Parallax Scrolling Enllax.js
  • Medium 4.3
    CVE-2025-58831

    WordPress Parallax Scrolling Enllax.js Plugin <= 0.0.6 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in snagysandor Parallax Scrolling Enllax.js parallax-scrolling-enllax-js allows Cross Site Request Forgery.This issue affects Parallax Scrolling Enllax.js: from n/a through <= 0.0.6.

    snagysandor Parallax Scrolling Enllax.js
  • Medium 4.9
    CVE-2025-58829

    WordPress Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One plugin <= 2.3.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One ai-auto-tool allows Server Side Request Forgery.This issue affects Ai Auto Tool Content Writing Assistant (Gemini Writer, Ch…

    aitool Ai Auto Tool Content Writing Assistant (Gemini Writer, ChatGPT ) All in One
  • Medium 6.5
    CVE-2025-58828

    WordPress 코드엠샵 소셜톡 plugin <= 1.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codemstory 코드엠샵 소셜톡 mshop-naver-talktalk allows Stored XSS.This issue affects 코드엠샵 소셜톡: from n/a through <= 1.2.2.

    codemstory
  • Medium 6.5
    CVE-2025-58826

    WordPress WP Publication Archive Plugin <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric Mann WP Publication Archive wp-publication-archive allows Stored XSS.This issue affects WP Publication Archive : from n/a through <= 3.0.1.

    Eric Mann WP Publication Archive
  • Medium 5.9
    CVE-2025-58825

    WordPress Comment Form WP – Customize Default Comment Form plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Habibur Rahman Comment Form WP – Customize Default Comment Form comment-form-wp allows Stored XSS.This issue affects Comment Form WP – Customize Default Comm…

    Habibur Rahman Comment Form WP – Customize Default Comment Form
  • Medium 6.5
    CVE-2025-58823

    WordPress Get Cash plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The African Boss Get Cash get-cash allows Stored XSS.This issue affects Get Cash: from n/a through <= 3.2.3.

    The African Boss Get Cash
  • Medium 4.3
    CVE-2025-58824

    WordPress Shk Corporate Theme <= 2.4.1.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shk Corporate: from n/a through <= 2.4.1.1.

    priyanshumittal Shk Corporate
  • Medium 6.5
    CVE-2025-58822

    WordPress WP Mail Plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mndpsingh287 WP Mail wp-mail allows DOM-Based XSS.This issue affects WP Mail: from n/a through <= 1.3.

    mndpsingh287 WP Mail
  • Medium 5.9
    CVE-2025-58821

    WordPress WP Notification Bell plugin <= 1.4.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpdever WP Notification Bell wp-notification-bell allows Stored XSS.This issue affects WP Notification Bell: from n/a through <= 1.4.6.

    wpdever WP Notification Bell
  • Medium 5.9
    CVE-2025-58820

    WordPress Carousel Ultimate Plugin <= 1.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themepoints Carousel Ultimate carousel allows Stored XSS.This issue affects Carousel Ultimate: from n/a through <= 1.8.

    Themepoints Carousel Ultimate
  • Medium 5.4
    CVE-2025-58818

    WordPress Developer Tools Blocker Plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in SwiftNinjaPro Developer Tools Blocker swiftninjapro-inspect-element-console-blocker allows Cross Site Request Forgery.This issue affects Developer Tools Blocker: from n/a through <= 3.2.1.

    SwiftNinjaPro Developer Tools Blocker
  • Medium 4.3
    CVE-2025-58817

    WordPress SoftMe Theme <= 1.1.27 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SoftMe: from n/a through <= 1.1.27.

    desertthemes SoftMe
  • Medium 6.5
    CVE-2025-58814

    WordPress Stagtools Plugin <= 2.3.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ram Ratan Maurya Stagtools stagtools allows Stored XSS.This issue affects Stagtools: from n/a through <= 2.3.8.

    Ram Ratan Maurya Stagtools
  • Medium 4.3
    CVE-2025-58813

    WordPress Consultstreet Theme <= 3.0.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Consultstreet: from n/a through <= 3.0.0.

    themearile Consultstreet
  • Medium 6.5
    CVE-2025-58812

    WordPress Best Restaurant Menu by PriceListo Plugin <= 1.4.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PriceListo Best Restaurant Menu by PriceListo best-restaurant-menu-by-pricelisto allows Stored XSS.This issue affects Best Restaurant Menu by PriceListo: fro…

    PriceListo Best Restaurant Menu by PriceListo
  • Medium 5.9
    CVE-2025-58811

    WordPress Ultimate Client Dash Plugin <= 4.7 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Ultimate Client Dash ulimate-client-dash allows Stored XSS.This issue affects Ultimate Client Dash: from n/a through <= 4.7.

    WP CodeUs Ultimate Client Dash
  • Medium 5.9
    CVE-2025-58810

    WordPress Simple Link List Widget Plugin <= 0.3.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jimmywb Simple Link List Widget simple-link-list-widget allows Stored XSS.This issue affects Simple Link List Widget: from n/a through <= 0.3.2.

    jimmywb Simple Link List Widget
  • Medium 6.5
    CVE-2025-58808

    WordPress prettyPhoto Plugin <= 1.2.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Babar prettyPhoto prettyphoto allows Stored XSS.This issue affects prettyPhoto: from n/a through <= 1.2.5.

    Babar prettyPhoto
  • Medium 5.9
    CVE-2025-58805

    WordPress Widgetize Pages Light Plugin <= 3.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light allows Stored XSS.This issue affects Widgetize Pages Light: from n/a through <= 3.0.

    otwthemes Widgetize Pages Light
  • Medium 4.3
    CVE-2025-58804

    WordPress WooCommerce Single Page Checkout Plugin <= 1.2.7 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in brijrajs WooCommerce Single Page Checkout woo-single-page-checkout allows Cross Site Request Forgery.This issue affects WooCommerce Single Page Checkout: from n/a through <= 1.2.7.

    brijrajs WooCommerce Single Page Checkout Web / CMS
  • Medium 4.3
    CVE-2025-58802

    WordPress TrustMate.io – WooCommerce integration plugin <= 1.16.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in michalzagdan TrustMate.io – WooCommerce integration trustmate-io-integration-for-woocommerce allows Cross Site Request Forgery.This issue affects TrustMate.io – WooCommerce integration: from n/a through <= 1.…

    michalzagdan TrustMate.io – WooCommerce integration Web / CMS
  • Medium 5.4
    CVE-2025-58801

    WordPress Responder Plugin <= 4.3.8 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in KCS Responder responder allows Cross Site Request Forgery.This issue affects Responder: from n/a through <= 4.3.8.

    KCS Responder
  • Medium 4.3
    CVE-2025-58800

    WordPress WP Email Template plugin <= 2.8.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Steve Truman WP Email Template wp-email-template allows Cross Site Request Forgery.This issue affects WP Email Template: from n/a through <= 2.8.5.

    Steve Truman WP Email Template
  • Medium 4.3
    CVE-2025-58799

    WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in themelocation Custom WooCommerce Checkout Fields Editor add-fields-to-checkout-page-woocommerce allows Cross Site Request Forgery.This issue affects Custom WooCommerce Checkout Fields Editor: from n/a through…

    themelocation Custom WooCommerce Checkout Fields Editor Web / CMS
  • Medium 4.3
    CVE-2025-58798

    WordPress BCM Duplicate Menu plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Bjorn Manintveld BCM Duplicate Menu bcm-duplicate-menu allows Cross Site Request Forgery.This issue affects BCM Duplicate Menu: from n/a through <= 1.1.3.

    Bjorn Manintveld BCM Duplicate Menu
  • Medium 6.5
    CVE-2025-58796

    WordPress Elementor Element Condition Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dudaster Elementor Element Condition ele-conditions allows Stored XSS.This issue affects Elementor Element Condition: from n/a through <= 1.0.5.

    dudaster Elementor Element Condition
  • Medium 5.3
    CVE-2025-58797

    WordPress Ninja Charts plugin <= 3.3.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Mahmudul Hasan Arif Ninja Charts ninja-charts allows Retrieve Embedded Sensitive Data.This issue affects Ninja Charts: from n/a through <= 3.3.5.

    Mahmudul Hasan Arif Ninja Charts
  • Medium 4.3
    CVE-2025-58795

    WordPress Payoneer Checkout Plugin <= 3.4.0 - Content Spoofing Vulnerability

    Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from n/a through <= 3.4.0.

    Payoneer Checkout Payoneer Checkout
  • Medium 4.3
    CVE-2025-58794

    WordPress Notification for Telegram plugin <= 3.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in rainafarai Notification for Telegram notification-for-telegram allows Cross Site Request Forgery.This issue affects Notification for Telegram: from n/a through <= 3.5.

    rainafarai Notification for Telegram
  • Medium 6.5
    CVE-2025-58793

    WordPress WPB Elementor Addons plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPBean WPB Elementor Addons wpb-elementor-addons allows Stored XSS.This issue affects WPB Elementor Addons: from n/a through <= 1.7.

    wpbean WPB Elementor Addons
  • Medium 4.3
    CVE-2025-58792

    WordPress Authors List plugin <= 2.0.6.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in WPKube Authors List authors-list allows Cross Site Request Forgery.This issue affects Authors List: from n/a through <= 2.0.6.2.

    WPKube Authors List
  • Medium 5.9
    CVE-2025-58791

    WordPress SEO Auto Linker Plugin <= 1.5.3 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arjan Olsder SEO Auto Linker wpa-seo-auto-linker allows Stored XSS.This issue affects SEO Auto Linker: from n/a through <= 1.5.3.

    Arjan Olsder SEO Auto Linker
  • Medium 6.5
    CVE-2025-58790

    WordPress Kiwi Plugin <= 2.1.8 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPKube Kiwi kiwi-social-share allows Stored XSS.This issue affects Kiwi: from n/a through <= 2.1.8.

    WPKube Kiwi
  • Medium 6.5
    CVE-2025-58787

    WordPress Themify Popup Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themifyme Themify Popup themify-popup allows Stored XSS.This issue affects Themify Popup: from n/a through <= 1.4.2.

    themifyme Themify Popup
  • Medium 6.5
    CVE-2025-58786

    WordPress Ibtana – Ecommerce Product Addons plugin <= 0.4.7.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VW THEMES Ibtana – Ecommerce Product Addons ibtana-ecommerce-product-addons allows DOM-Based XSS.This issue affects Ibtana – Ecommerce Product Addons: from n…

    VW THEMES Ibtana – Ecommerce Product Addons
  • Medium 5.4
    CVE-2025-58785

    WordPress Ray Enterprise Translation plugin <= 1.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ray Enterprise Translation: from n/a through <= 1.7.2.

    Jiro Sasamoto Ray Enterprise Translation
  • Medium 6.5
    CVE-2025-58784

    WordPress ARI Fancy Lightbox Plugin <= 1.4.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in arisoft ARI Fancy Lightbox ari-fancy-lightbox allows Stored XSS.This issue affects ARI Fancy Lightbox: from n/a through <= 1.4.0.

    ARI Soft ARI Fancy Lightbox