Skip to content
OpenAdvisories

Archive

4 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /4 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Medium 6.3
    CVE-2025-11273

    LaChatterie Verger provider.ts redirectToAuthorization deserialization

    A vulnerability was found in LaChatterie Verger up to 1.2.10. This impacts the function redirectToAuthorization of the file /src/main/services/mcp/oauth/provider.ts. The manipulation of the argument URL results in deserialization. The attack can be executed r…

    LaChatterie Verger
  • Medium 5.4
    CVE-2025-11272

    SeriaWei ZKEACMS POST Request UrlRedirectionController.cs Delete improper authorization

    A vulnerability has been found in SeriaWei ZKEACMS up to 4.3. This affects the function Delete of the file src/ZKEACMS.Redirection/Controllers/UrlRedirectionController.cs of the component POST Request Handler. The manipulation leads to improper authorization.…

    SeriaWei ZKEACMS
  • Medium 4.3
    CVE-2025-9886 Public exploit

    Trinity Audio <= 5.20.2 - Cross-Site Request Forgery

    The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin…

    sergiotrinity Trinity Audio – Text to Speech AI audio player to convert content into audio Web / CMS
  • Medium 6.4
    CVE-2025-10383

    Contest Gallery – Upload, Vote & Sell with PayPal and Stripe <= 27.0.2 - Authenticated (Author+) Stored Cross-Site Scripting

    The Contest Gallery – Upload, Vote & Sell with PayPal and Stripe plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple form field parameters in all versions up to, and including, 27.0.2. This is due to insufficient input sanitization …

    contest-gallery Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe Web / CMS
  • Medium 6.1
    CVE-2025-9952

    Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting

    The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'range-date' parameter in all versions up to, and including, 5.20.2 due to insufficient input sanitiz…

    sergiotrinity Trinity Audio – Text to Speech AI audio player to convert content into audio Web / CMS
  • Medium 4.3
    CVE-2025-9029

    WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder <= 1.2.16 - Missing Authentication via wdkit_handle_review_submission Function

    The WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder plugin for WordPress is vulnerable to missing authorization via the wdkit_handle_review_submission function in versions less than, or equal to, 1.2.16. This i…

    posimyththemes WDesignKit – Elementor & Gutenberg Starter Templates, Patterns, Cloud Workspace & Widget Builder Web / CMS
  • Medium 5.3
    CVE-2025-11228

    GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms-Campaign Association

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `registerAssociateFormsWithCampaign` function in all versions up to, and including, 4.10.0. …

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 5.4
    CVE-2025-9030

    Majestic Before After Image <= 2.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting

    The Majestic Before After Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'before_label' and 'after_label' parameters in versions less than, or equal to, 2.0.1 due to insufficient input sanitization and output escaping. This ma…

    maneshtimilsina Majestic Before After Image Web / CMS
  • Medium 6.5
    CVE-2025-10746

    Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization

    The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes it possible for una…

    cyberlord92 Integrate Dynamics 365 CRM Web / CMS
  • Medium 6.5
    CVE-2025-11227

    GiveWP – Donation Plugin and Fundraising Platform <= 4.10.0 - Missing Authorization to Unauthenticated Forms and Campaigns Disclosure

    The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.10.0 via the 'registerGetForm', 'registerGetForms', 'registerGetCampaign' and 'registerGetCampaigns' funct…

    stellarwp GiveWP – Donation Plugin and Fundraising Platform Web / CMS
  • Medium 5.4
    CVE-2025-8726

    WP Photo Album Plus <= 9.0.11.006 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wppa_user_upload

    The WP Photo Album Plus plugin for WordPress is vulnerable to Cross-Site Scripting in all versions up to, and including, 9.0.11.006 due to insufficient input sanitization and output escaping in the wppa_user_upload function. This makes it possible for authent…

    opajaap WP Photo Album Plus Web / CMS
  • Medium 5.9
    CVE-2025-61962

    In fetchmail before 6.5.6, the SMTP client can crash when authenticating upon receiving a 334 status code in a malforme…

    fetchmail fetchmail fetchmail fetchmail Debian Ubuntu Azure Linux Alpine