Skip to content
OpenAdvisories

Archive

22 November 2025

Vulnerabilities first published on this day (UTC), newest first.

← October 2025 2025 / November /22 December 2025 →
  1. 133
  2. 29
  3. 361
  4. 4260
  5. 5102
  6. 6244
  7. 7119
  8. 839
  9. 97
  10. 10122
  11. 11323
  12. 12212
  13. 13154
  14. 14112
  15. 1526
  16. 1623
  17. 17128
  18. 18182
  19. 19125
  20. 2099
  21. 21163
  22. 228
  23. 2332
  24. 24104
  25. 25120
  26. 26101
  27. 2755
  28. 2843
  29. 2927
  30. 3023
All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-13136

    GSheetConnector For Ninja Forms <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) System Information Exposure

    The GSheetConnector For Ninja Forms plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'njform-google-sheet-config ' page in all versions up to, and including, 2.0.1. This makes it possible for authentic…

    westerndeal GSheetConnector For Ninja Forms Web / CMS
  • Medium 5.3
    CVE-2025-13318

    Booking Calendar Contact Form <= 1.2.60 - Missing Authorization to Unauthenticated Arbitrary Booking Confirmation via 'dex_bccf_ipn' Parameter

    The Booking Calendar Contact Form plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.60. This is due to missing authorization checks and payment verification in the `dex_bccf_check_IPN_verification` function.…

    codepeople Booking Calendar Contact Form Web / CMS
  • Medium 5.3
    CVE-2025-12877

    IDonate – Blood Donation, Request And Donor Management System <= 2.1.15 - Missing Authorization to Unauthenticated Arbitrary Post Deletion

    The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification od data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.…

    faysal61 IDonate – Blood Donation, Request And Donor Management System Web / CMS
  • Medium 5.3
    CVE-2025-12752

    Subscriptions & Memberships for PayPal <= 1.1.7 - Unauthenticated Fake Payment Creation

    The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to, and including, 1.1.7. This is due to the plugin not properly verifying the authenticity of an IPN request. This makes it possible for…

    Scott Paterson Subscriptions & Memberships for PayPal Web / CMS
  • Medium 5.3
    CVE-2025-13317

    Appointment Booking Calendar <= 1.3.96 - Missing Authorization to Arbitrary Booking Confirmation via 'cpabc_ipncheck' Parameter

    The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.96. This is due to the plugin exposing an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verifica…

    codepeople Appointment Booking Calendar Web / CMS
  • Medium 6.4
    CVE-2025-11186

    Cookie Notice & Compliance for GDPR / CCPA <= 2.5.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping…

    Hu-manity.co Cookie Notice & Compliance for GDPR / CCPA Web / CMS