Skip to content
OpenAdvisories

Archive

21 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /21 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.2
    CVE-2025-12973 Public exploit

    S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator <= 1.7.8 - Authenticated (Editor+) Arbitrary File Upload

    The S2B AI Assistant – ChatBot, ChatGPT, OpenAI, Content & Image Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the storeFile() function in all versions up to, and including, 1.7.8. This makes it …

    oc3dots S2B AI Assistant – ChatBot, AI Agents, ChatGPT API, Image Generator Web / CMS
  • Critical 10.0
    CVE-2025-41115 Public exploit EPSS 17%

    Incorrect privilege assignment

    SCIM provisioning was introduced in Grafana Enterprise and Grafana Cloud in April to improve how organizations manage users and teams in Grafana by introducing automated user lifecycle management. In Grafana versions 12.x where SCIM provisioning is enabled an…

    Grafana Grafana Enterprise github.com/grafana/grafana Web / CMS Go
  • High 8.8
    CVE-2025-13156 Public exploit

    Vitepos – Point of Sale (POS) for WooCommerce <= 3.3.0 - Authenticated (Subscriber+) Arbitrary File Upload to Remote Code Execution

    The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the insert_media_attachment() function in all versions up to, and including, 3.3.0. This is due to the save_u…

    Appsbd Vitepos – Point of Sale (POS) for WooCommerce Web / CMS
  • Medium 4.9
    CVE-2025-11973 Public exploit

    简数采集器 <= 2.6.3 - Authenticated (Admin+) Arbitrary File Read

    The 简数采集器 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.6.3 via the __kds_flag functionality that imports featured images. This makes it possible for authenticated attackers, with Adminstrator-level access a…

    zhengdon Web / CMS
  • Medium 5.3
    CVE-2025-11771 Public exploit

    Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO <= 2.4.7 - Missing Authentication to Unauthenticated Presale Update

    The Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO plugin for WordPress is vulnerable to unauthenticated and unauthorized modification of data due to missing authentication and capability checks on the 'createSaleRecord' function …

    beycanpress Cryptocurrency (Token), Launchpad (Presale), ICO & IDO, Airdrop by TokenICO Web / CMS
  • High 7.1
    CVE-2025-13159 Public exploit

    Flo Forms – Easy Drag & Drop Form Builder <= 1.0.43 - Unauthenticated Stored Cross-Site Scripting via SVG Upload

    The Flo Forms – Easy Drag & Drop Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in all versions up to, and including, 1.0.43. This is due to the plugin allowing SVG file uploads via an unauthenticated AJAX …

    flothemesplugins Flo Forms – Easy Drag & Drop Form Builder Web / CMS
  • High 7.2
    CVE-2025-12135 Public exploit

    WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting

    The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css_code' parameter in all versions up to, and including, 1.0.6 due to a missing capability check on the save_custome_code() function. This makes it possible for unauthent…

    Iqonic Design WPBookit Web / CMS