Skip to content
OpenAdvisories

Archive

29 October 2025

Vulnerabilities first published on this day (UTC), newest first.

← September 2025 2025 / October /29 November 2025 →
  1. 1246
  2. 2120
  3. 3158
  4. 4159
  5. 539
  6. 6114
  7. 7241
  8. 8103
  9. 9170
  10. 10126
  11. 1176
  12. 1236
  13. 1391
  14. 14370
  15. 15189
  16. 16132
  17. 1787
  18. 1873
  19. 1911
  20. 2081
  21. 21156
  22. 22393
  23. 2398
  24. 2499
  25. 2539
  26. 266
  27. 27315
  28. 28147
  29. 29161
  30. 30203
  31. 31103
All Critical High Medium Low Exploited only Public exploit

96 results · Clear filters · Feed

  • Medium 5.9
    CVE-2025-64200

    WordPress Email Template Customizer for WooCommerce plugin <= 1.2.17 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-template-customizer-for-woo allows Stored XSS.This issue affects Email Template Customizer for Woo…

    villatheme Email Template Customizer for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-64197

    WordPress Rehub theme < 19.9.9.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sizam Rehub rehub-theme allows Stored XSS.This issue affects Rehub: from n/a through < 19.9.9.1.

    sizam Rehub
  • Medium 6.5
    CVE-2025-64194

    WordPress Eduma theme <= 5.7.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress Eduma eduma allows Stored XSS.This issue affects Eduma: from n/a through <= 5.7.6.

    ThimPress Eduma
  • Medium 4.3
    CVE-2025-58939

    WordPress Super Store Finder plugin <= 7.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super Store Finder: from n/a through <= 7.5.

    highwarden Super Store Finder
  • Medium 5.3
    CVE-2025-58711

    WordPress Blog Designer PRO plugin <= 3.4.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in solwin Blog Designer PRO blog-designer-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blog Designer PRO: from n/a through <= 3.4.8.

    solwin Blog Designer PRO
  • Medium 5.3
    CVE-2023-7320

    WooCommerce <= 7.8.2 - Sensitive Information Exposure

    The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unaut…

    Automattic WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-9544

    Doppler Forms <= 2.5.1 - Subscriber+ Limited Plugin Installation

    The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action install_extension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additio…

    Web / CMS
  • Medium 5.9
    CVE-2025-49042

    WordPress WooCommerce plugin <= 10.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooCommerce woocommerce allows Stored XSS.This issue affects WooCommerce: from n/a through <= 10.0.2.

    Automattic WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-11705

    Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read

    The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 4.23.81 due to a missing capability check combined with an information exposure in several GOTMLS_* AJAX actions…

    scheeeli Anti-Malware Security and Brute-Force Firewall Web / CMS
  • Medium 5.3
    CVE-2025-64296

    WordPress Facebook for WooCommerce plugin <= 3.5.7 - Broken Access Control to Notice Dismissal vulnerability

    Missing Authorization vulnerability in Facebook Facebook for WooCommerce facebook-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Facebook for WooCommerce: from n/a through <= 3.5.7.

    Facebook Facebook for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-57931

    WordPress Popup box plugin <= 5.5.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 5.5.4.

    Ays Pro Popup box
  • Medium 4.6
    CVE-2024-45161

    A CSRF issue was discovered in the administrative web GUI in Blu-Castle BCUM221E 1.0.0P220507. This can be exploited vi…

  • Medium 5.0
    CVE-2025-61876

    Insecure Direct Object Reference (IDOR) in /tenants/{id} API endpoint in Inforcer Platform version 2.0.153 allows an au…

  • Medium 5.8
    CVE-2025-60898

    An unauthenticated server-side request forgery (SSRF) vulnerability in the Thumbnail via-uri endpoint of Halo CMS 2.21 …

  • Medium 6.7
    CVE-2025-60320

    memoQ 10.1.13.ef1b2b52aae and earlier contains an unquoted service path vulnerability in the memoQ Auto Update Service …

  • Medium 6.5
    CVE-2025-60542

    TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update

    SQL Injection vulnerability in TypeORM before 0.3.26 via crafted request to repository.save or repository.update due to the sqlstring call using stringifyObjects default to false.

    typeorm npm