Skip to content
OpenAdvisories

Archive

22 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /22 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

138 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-62048

    WordPress SmartCrawl plugin <= 3.14.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through <= 3.14.3.

    WPMU DEV - Your All-in-One WordPress Platform SmartCrawl
  • Medium 4.3
    CVE-2025-62052

    WordPress One Page Express Companion plugin <= 1.6.43 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.

    Horea Radu One Page Express Companion
  • Medium 5.4
    CVE-2025-62027

    WordPress Event Tickets plugin <= 5.26.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3.

    stellarwp Event Tickets
  • Medium 6.5
    CVE-2025-62042

    WordPress Event post plugin <= 5.10.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bastien Ho Event post event-post.This issue affects Event post: from n/a through <= 5.10.3.

    Bastien Ho Event post
  • Medium 6.5
    CVE-2025-62024

    WordPress Pie Calendar plugin <= 1.2.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Jernigan Pie Calendar pie-calendar.This issue affects Pie Calendar: from n/a through <= 1.2.9.

    Jonathan Jernigan Pie Calendar
  • Medium 4.3
    CVE-2025-62026

    WordPress Blockspare plugin <= 3.2.13.2 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Blockspare Blockspare blockspare allows Retrieve Embedded Sensitive Data.This issue affects Blockspare: from n/a through <= 3.2.13.2.

    blockspare Blockspare
  • Medium 4.3
    CVE-2025-62021

    WordPress Acknowledgify plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through <= 1.1.3.

    Made Neat Acknowledgify
  • Medium 6.5
    CVE-2025-62019

    WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.

    WPZOOM Recipe Card Blocks for Gutenberg & Elementor
  • Medium 4.3
    CVE-2025-62009

    WordPress UPC/EAN/GTIN Code Generator plugin <= 2.0.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Cross Site Request Forgery.This issue affects UPC/EAN/GTIN Code Generator: from n/a through <= 2.0.2.

    Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator
  • Medium 4.3
    CVE-2025-62013

    WordPress UiChemy plugin <= 4.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0.

    POSIMYTH UiChemy
  • Medium 5.4
    CVE-2025-62006

    WordPress WP SMS plugin <= 7.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1.

    VeronaLabs WP SMS
  • Medium 5.9
    CVE-2025-60176

    WordPress WP Tesseract Plugin <= 1.0.2 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tattersoftware WP Tesseract wp-tesseract allows Stored XSS.This issue affects WP Tesseract: from n/a through <= 1.0.2.

    tattersoftware WP Tesseract
  • Medium 5.9
    CVE-2025-60135

    WordPress WeShare Buttons Plugin <= 13.0.0 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NIKITAS GEORGOPOULOS WeShare Buttons e-mailit allows Stored XSS.This issue affects WeShare Buttons: from n/a through <= 13.0.0.

    NIKITAS GEORGOPOULOS WeShare Buttons
  • Medium 4.7
    CVE-2025-60151

    WordPress WP Gravity Forms HubSpot Plugin <= 1.2.5 - Open Redirection Vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms HubSpot gf-hubspot allows Phishing.This issue affects WP Gravity Forms HubSpot: from n/a through <= 1.2.5.

    CRM Perks WP Gravity Forms HubSpot
  • Medium 4.3
    CVE-2025-60134

    WordPress WP Media Categories Plugin <= 2.1.0 - Cross Site Request Forgery (CSRF) Vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through <= 2.1.0.

    John James Jacoby WP Media Categories
  • Medium 5.9
    CVE-2025-60131

    WordPress Werk aan de Muur Plugin <= 1.5 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS.This issue affects Werk aan de Muur: from n/a through <= 1.5.

    Zoefff Werk aan de Muur
  • Medium 5.9
    CVE-2025-59593

    WordPress Colibri Page Builder Plugin < 1.0.334 - Cross Site Scripting (XSS) Vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.

    Extend Themes Colibri Page Builder
  • Medium 5.8
    CVE-2025-59578

    WordPress ShopMagic plugin <= 4.5.6 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects ShopMagic: from n/a through <= 4.5.6.

    WP Desk ShopMagic
  • Medium 4.9
    CVE-2025-59575

    WordPress MasterStudy LMS plugin <= 3.6.20 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Retrieve Embedded Sensitive Data.This issue affects MasterStudy LMS: from n/a through <= 3.6…

    stylemix MasterStudy LMS
  • Medium 6.3
    CVE-2025-58970

    WordPress Doctreat theme <= 1.6.7 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.

    AmentoTech Doctreat
  • Medium 6.5
    CVE-2025-53424

    WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through …

    vanquish WooCommerce Orders & Customers Exporter Web / CMS
  • Medium 6.5
    CVE-2025-53421

    WordPress Accordion plugin <= 2.3.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.

    PickPlugins Accordion
  • Medium 5.8
    CVE-2025-53232

    WordPress WP Gmail SMTP plugin <= 1.0.7 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in inkthemes WP Gmail SMTP wp-gmail-smtp allows Retrieve Embedded Sensitive Data.This issue affects WP Gmail SMTP: from n/a through <= 1.0.7.

    inkthemes WP Gmail SMTP
  • Medium 6.3
    CVE-2025-53236

    WordPress UDesign Core plugin <= 4.14.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in AndonDesign UDesign Core u-design-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UDesign Core: from n/a through <= 4.14.0.

    AndonDesign UDesign Core
  • Medium 5.8
    CVE-2025-53218

    WordPress AppExperts plugin <= 1.4.5 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Saad Iqbal AppExperts appexperts allows Retrieve Embedded Sensitive Data.This issue affects AppExperts: from n/a through <= 1.4.5.

    Saad Iqbal AppExperts
  • Medium 6.5
    CVE-2025-52757

    WordPress SUMO Memberships for WooCommerce plugin < 7.8.0 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in FantasticPlugins SUMO Memberships for WooCommerce sumomemberships allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SUMO Memberships for WooCommerce: from n/a through < 7.8.0.

    Fantastic Plugins SUMO Memberships for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-52752

    WordPress IDonatePro plugin <= 2.1.9 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeAtelier IDonatePro idonate-pro allows Retrieve Embedded Sensitive Data.This issue affects IDonatePro: from n/a through <= 2.1.9.

    themeatelier IDonatePro
  • Medium 6.5
    CVE-2025-52738

    WordPress Wikipedia Preview plugin <= 1.15.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Wikimedia Foundation Wikipedia Preview wikipedia-preview allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wikipedia Preview: from n/a through <= 1.15.0.

    Wikimedia Foundation Wikipedia Preview
  • Medium 6.5
    CVE-2025-49960

    WordPress LeadBI Plugin for WordPress plugin <= 1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in leadbi LeadBI Plugin for WordPress leadbi allows Stored XSS.This issue affects LeadBI Plugin for WordPress: from n/a through <= 1.7.

    leadbi LeadBI Plugin for WordPress Web / CMS
  • Medium 6.5
    CVE-2025-49961

    WordPress Breeze Checkout plugin <= 1.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.

    Breeze Team Breeze Checkout
  • Medium 6.5
    CVE-2025-49952

    WordPress Houzez theme <= 4.2.5 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in favethemes Houzez houzez allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Houzez: from n/a through <= 4.2.5.

    Fave Themes Houzez
  • Medium 5.4
    CVE-2025-49949

    WordPress Templazee plugin <= 1.0.2 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in templazee Templazee templazee allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templazee: from n/a through <= 1.0.2.

    templazee Templazee
  • Medium 6.5
    CVE-2025-49939

    WordPress JetElements For Elementor plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through <= 2.7.8.

    Crocoblock JetElements For Elementor
  • Medium 6.5
    CVE-2025-49940

    WordPress Fusion Builder plugin <= 3.13.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeFusion Fusion Builder fusion-builder allows DOM-Based XSS.This issue affects Fusion Builder: from n/a through <= 3.13.2.

    ThemeFusion Fusion Builder
  • Medium 6.5
    CVE-2025-49936

    WordPress WoodMart theme < 8.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xtemos WoodMart woodmart allows DOM-Based XSS.This issue affects WoodMart: from n/a through < 8.3.2.

    Xtemos WoodMart
  • Medium 4.3
    CVE-2025-49937

    WordPress Smash Balloon Social Post Feed plugin <= 4.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Syed Balkhi Smash Balloon Social Post Feed custom-facebook-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Smash Balloon Social Post Feed: from n/a through <= 4.3.2.

    Syed Balkhi Smash Balloon Social Post Feed
  • Medium 6.5
    CVE-2025-49938

    WordPress JetEngine plugin <= 3.7.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows Stored XSS.This issue affects JetEngine: from n/a through <= 3.7.3.

    Crocoblock JetEngine
  • Medium 6.5
    CVE-2025-49934

    WordPress JetBlocks For Elementor plugin <= 1.3.18 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through <= 1.3.18.

    Crocoblock JetBlocks For Elementor
  • Medium 6.5
    CVE-2025-49933

    WordPress JetBlog plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through <= 2.4.4.

    Crocoblock JetBlog
  • Medium 6.5
    CVE-2025-49932

    WordPress JetBlog plugin <= 2.4.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Stored XSS.This issue affects JetBlog: from n/a through <= 2.4.4.1.

    Crocoblock JetBlog