Skip to content
OpenAdvisories

Archive

6 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /6 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

69 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-62018

    WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

    Hogash KALLYAS
  • Medium 5.4
    CVE-2025-62017

    WordPress Kallyas theme <= 4.22.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in hogash KALLYAS kallyas.This issue affects KALLYAS: from n/a through <= 4.22.0.

    Hogash KALLYAS
  • Medium 6.5
    CVE-2025-62012

    WordPress TheGem (Elementor) theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem (Elementor) thegem-elementor.This issue affects TheGem (Elementor): from n/a through <= 5.10.5.

    CodexThemes TheGem (Elementor)
  • Medium 6.5
    CVE-2025-62011

    WordPress TheGem theme <= 5.10.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem thegem.This issue affects TheGem: from n/a through <= 5.10.5.

    CodexThemes TheGem
  • Medium 6.5
    CVE-2025-60247

    WordPress Bux Woocommerce plugin <= 1.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Bux Bux Woocommerce bux-woocommerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Bux Woocommerce: from n/a through <= 1.2.3.

    Bux Bux Woocommerce Web / CMS
  • Medium 4.8
    CVE-2025-60187

    WordPress Atarim plugin <= 4.2.1 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Using Malicious Files.This issue affects Atarim: from n/a through <= 4.2.1.

    Vito Peleg Atarim
  • Medium 6.5
    CVE-2025-58986

    WordPress Jock On Air Now (JOAN) plugin <= 6.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ganddser Jock On Air Now (JOAN) joan allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Jock On Air Now (JOAN): from n/a through <= 6.0.4.

    ganddser Jock On Air Now (JOAN)
  • Medium 5.3
    CVE-2025-58595

    WordPress All In One Login plugin <= 2.0.8 - Bypass Vulnerability vulnerability

    Authentication Bypass by Spoofing vulnerability in Saad Iqbal All In One Login change-wp-admin-login allows Identity Spoofing.This issue affects All In One Login: from n/a through <= 2.0.8.

    Saad Iqbal All In One Login
  • Medium 5.3
    CVE-2025-58243

    WordPress imEvent Theme <= 3.4.0 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Jthemes imEvent imevent allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects imEvent: from n/a through <= 3.4.0.

    Jthemes imEvent
  • Medium 5.3
    CVE-2025-5803

    WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through <= 1.8.2.

    e4jvikwp VikBooking Hotel Booking Engine & PMS
  • Medium 6.5
    CVE-2025-53246

    WordPress Backup and Move Plugin <= 0.1 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in Gaurav Aggarwal Backup and Move backup-and-move allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backup and Move: from n/a through <= 0.1.

    Gaurav Aggarwal Backup and Move
  • Medium 6.5
    CVE-2025-53214

    WordPress Sertifier Certificate & Badge Maker plugin <= 1.21 - Broken Access Control Vulnerability

    Missing Authorization vulnerability in sertifier Sertifier Certificate & Badge Maker sertifier-certificates-open-badges allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sertifier Certificate & Badge Maker: from n/a th…

    sertifier Sertifier Certificate & Badge Maker
  • Medium 6.5
    CVE-2025-49398

    WordPress Easy Appointments plugin <= 3.12.14 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Easy Appointments Easy Appointments easy-appointments allows Code Injection.This issue affects Easy Appointments: from n/a through <= 3.12.14.

    Easy Appointments Easy Appointments
  • Medium 5.5
    CVE-2025-48086

    WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.

    WPdreams Ajax Search Lite
  • Medium 4.3
    CVE-2025-39465

    WordPress Advanced Google Maps plugin <= 5.8.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in flippercode Advanced Google Maps wp-google-map-gold allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Advanced Google Maps: from n/a through <= 5.8.4.

    Flipper Code Advanced Google Maps
  • Medium 4.1
    CVE-2025-22288

    WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability

    Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through <= 3.17.0.

    WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization
  • Medium 6.1
    CVE-2025-10955

    HTML Injection in Netcad Software's Netigma

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netcad Software Inc. Netigma allows XSS Through HTTP Query Strings. This issue affects Netigma: from 6.3.5 before 6.3.5 V8.

    Netcad Software Netigma
  • Medium 6.1
    CVE-2025-36054

    Cross-site scripting vulnerability affect IBM Business Automation Workflow Process Federation Server -

    IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable t…

    IBM Business Automation Workflow containers Business Automation Workflow traditional with Process Federation Server
  • Medium 4.3
    CVE-2025-11268

    Strong Testimonials <= 3.2.16 - Unauthenticated Arbitrary Shortcode Execution

    The Strong Testimonials plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.2.16. This is due to the software allowing users to submit a testimonial in which a value is not properly validated or sanitize…

    WP Chill Strong Testimonials Web / CMS
  • Medium 4.3
    CVE-2025-12360

    Better Find and Replace <= 1.7.7 - Missing Authorization

    The Better Find and Replace – AI-Powered Suggestions plugin for WordPress is vulnerable to unauthorized API usage due to a missing capability check on the rtafar_ajax() function in all versions up to, and including, 1.7.7. This makes it possible for authentic…

    codesolz Better Find and Replace – AI-Powered Suggestions Web / CMS
  • Medium 5.3
    CVE-2025-10259

    Denial-of-Service(DoS) Vulnerability in TCP Communication Function on MELSEC iQ-F Series CPU module

    Improper Validation of Specified Quantity in Input vulnerability in TCP Communication Function on Mitsubishi Electric Corporation MELSEC iQ-F Series CPU module allows a remote attacker to disconnect the connection by sending specially crafted TCP packets to c…

    Mitsubishi Electric MELSEC iQ-F Series FX5U-64MT/ES MELSEC iQ-F Series FX5UC-96MT/D MELSEC iQ-F Series FX5U-80MT/DSS ICS / OT
  • Medium 6.1
    CVE-2025-12471

    Hubbub Lite <= 1.36.0 - Reflected Cross-Site Scripting

    The Hubbub Lite – Fast, free social sharing and follow buttons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dpsp_list_attention_search' parameter in all versions up to, and including, 1.36.0 due to insufficient input sanitizat…

    nerdpressteam Hubbub Lite – Fast, free social sharing and follow buttons Web / CMS
  • Medium 4.3
    CVE-2025-12560

    Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Authenticated (Subscriber+) Blind Server-Side Request Forgery via post_url

    The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 8.6.0 via the getFullContent() function. This makes it possible for authenticated attackers, with Subsc…

    pr-gateway Blog2Social: Social Media Auto Post & Scheduler Web / CMS
  • Medium 5.3
    CVE-2025-11271

    Easy Digital Download <= 3.5.2 - Insufficient Verification to Order Manipulation

    The Easy Digital Downloads plugin for WordPress is vulnerable to Order Manipulation in all versions up to, and including, 3.5.2 due to an order verification bypass. The verification is unconditionally skipped when the POST body includes verification_override=…

    smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Web / CMS
  • Medium 4.3
    CVE-2025-12563

    Blog2Social: Social Media Auto Post & Scheduler <= 8.6.0 - Incorrect Authorization to Video File Upload

    The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to limited file upload due to an incorrect capability check on theuploadVideo() function in all versions up to, and including, 8.6.0. This makes it possible for authenticat…

    pr-gateway Blog2Social: Social Media Auto Post & Scheduler Web / CMS
  • Medium 5.4
    CVE-2025-61994

    Cross-site scripting vulnerability exists in GROWI prior to v7.2.10. If a malicious user creates a page containing craf…

    GROWI GROWI
  • Medium 4.3
    CVE-2025-10691

    Easy Email Subscription <= 1.3 - Cross-Site Request Forgery to Arbitrary Subscriber Deletion

    The Easy Email Subscription plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the show_editsub_page() function. This makes it possible for unauth…

    Yudiz Solutions Easy Email Subscription Web / CMS
  • Medium 4.9
    CVE-2025-10683

    Easy Email Subscription <= 1.3 - Authenticated (Admin+) SQL Injection via uid

    The Easy Email Subscription plugin for WordPress is vulnerable to SQL Injection via the 'uid' parameter in all versions up to, and including, 1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQ…

    Yudiz Solutions Easy Email Subscription Web / CMS
  • Medium 6.8
    CVE-2025-59392

    On Elspec G5 devices through 1.2.2.19, a person with physical access to the device can reset the Admin password by inse…