Skip to content
OpenAdvisories

Archive

9 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /9 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

287 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-67592

    WordPress My Calendar plugin <= 3.6.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Calendar: from n/a through <= 3.6.16.

    Joe Dolson my-calendar
  • Medium 4.3
    CVE-2025-67589

    WordPress WooCommerce PDF Invoices & Packing Slips plugin <= 4.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing S…

    WP Overnight woocommerce-pdf-invoices-packing-slips Web / CMS
  • Medium 4.3
    CVE-2025-67591

    WordPress JNews Paywall plugin < 12.0.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Request Forgery.This issue affects JNews Paywall: from n/a through < 12.0.1.

    jegtheme JNews Paywall
  • Medium 4.3
    CVE-2025-67590

    WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: from n/a through <= 2.4.3.

    Rustaurius Ultimate FAQ
  • Medium 4.3
    CVE-2025-67593

    WordPress UsersWP plugin <= 1.2.48 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1.2.48.

    Stiofan UsersWP
  • Medium 4.7
    CVE-2025-67586 Public exploit

    WordPress Highlight and Share plugin <= 5.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Highlight and Share: from n/a through <= 5.2.0.

    Ronald Huereca Highlight and Share
  • Medium 4.7
    CVE-2025-67585

    WordPress Flexmls® IDX plugin <= 3.15.7 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a through <= 3.15.7.

    flexmls Flexmls® IDX
  • Medium 4.7
    CVE-2025-67587

    WordPress WP Gravity Forms FreshDesk Plugin plugin <= 1.3.5 - Open Redirection vulnerability

    URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affects WP Gravity Forms FreshDesk Plugin: from n/a through <= 1.3.5.

    CRM Perks WP Gravity Forms FreshDesk Plugin
  • Medium 4.3
    CVE-2025-67588

    WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through <= 3.33.0.

    Elementor Elementor Website Builder
  • Medium 5.3
    CVE-2025-67581

    WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through <= 1.1.0.

    themetechmount TrueBooker
  • Medium 5.3
    CVE-2025-67584

    WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: from n/a through <= 1.4.6.

    rtcamp GoDAM
  • Medium 5.3
    CVE-2025-67583

    WordPress IDonate plugin <= 2.1.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IDonate: from n/a through <= 2.1.15.

    Foysal Imran IDonate
  • Medium 5.3
    CVE-2025-67580

    WordPress Constant Contact + WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Constant Contact + WooCommerce: from n/a through <= …

    Constant Contact Constant Contact + WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-67582

    WordPress Wbcom Designs plugin <= 2.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wbcom Designs: from n/a through <= 2.1.1.

    Wbcom Designs Wbcom Designs
  • Medium 5.3
    CVE-2025-67578

    WordPress WP Email Capture plugin <= 3.12.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Email Capture: from n/a through <= 3.12.4.

    Rhys Wynne WP Email Capture
  • Medium 5.3
    CVE-2025-67577

    WordPress Easy Form Builder plugin <= 3.8.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Form Builder: from n/a through <= 3.8.20.

    hassantafreshi Easy Form Builder
  • Medium 5.3
    CVE-2025-67579

    WordPress User Extra Fields plugin <= 16.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Extra Fields: from n/a through <= 16.8.

    vanquish User Extra Fields
  • Medium 5.3
    CVE-2025-67576

    WordPress Simple Link Directory plugin <= 8.8.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Link Directory: from n/a through <= 8.8.3.

    Quantum Cloud Simple Link Directory
  • Medium 5.3
    CVE-2025-67573

    WordPress Sailing theme < 4.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sailing: from n/a through < 4.4.6.

    ThimPress Sailing
  • Medium 5.3
    CVE-2025-67572

    WordPress PenNews theme < 6.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PenNews: from n/a through < 6.7.4.

    PenciDesign PenNews
  • Medium 5.3
    CVE-2025-67575

    WordPress Sitewide Notice WP plugin <= 2.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sitewide Notice WP: from n/a through <= 2.4.1.

    Andrew Lima Sitewide Notice WP
  • Medium 5.3
    CVE-2025-67574

    WordPress Booking calendar, Appointment Booking System plugin <= 3.2.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking calendar, Appointment Booking System: from n/a thr…

    wpdevart Booking calendar, Appointment Booking System
  • Medium 5.3
    CVE-2025-67568

    WordPress Basel theme <= 5.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: from n/a through <= 5.9.1.

    Xtemos Basel
  • Medium 5.3
    CVE-2025-67571

    WordPress WPFunnels plugin <= 3.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPFunnels: from n/a through <= 3.6.2.

    WPFunnels WPFunnels
  • Medium 5.3
    CVE-2025-67569

    WordPress AdForest theme <= 6.0.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AdForest: from n/a through <= 6.0.11.

    scriptsbundle AdForest
  • Medium 5.3
    CVE-2025-67570

    WordPress WPForms Google Sheet Connector plugin <= 4.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPForms Google Sheet Connector: from n/a through <= 4.0.0.

    westerndeal WPForms Google Sheet Connector
  • Medium 5.3
    CVE-2025-67567

    WordPress Sober theme <= 3.5.11 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This issue affects Sober: from n/a through <= 3.5.11.

    uixthemes Sober
  • Medium 5.3
    CVE-2025-67563

    WordPress Post SMTP plugin <= 3.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saad Iqbal Post SMTP post-smtp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post SMTP: from n/a through <= 3.6.1.

    Saad Iqbal Post SMTP
  • Medium 5.3
    CVE-2025-67566

    WordPress Woffice Core plugin <= 5.4.30 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.

    WofficeIO Woffice Core
  • Medium 5.3
    CVE-2025-67565

    WordPress Rehub theme <= 19.9.9.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam Rehub rehub-theme allows Retrieve Embedded Sensitive Data.This issue affects Rehub: from n/a through <= 19.9.9.1.

    sizam Rehub
  • Medium 5.3
    CVE-2025-67564

    WordPress Pixel Manager for WooCommerce plugin <= 1.51.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in alekv Pixel Manager for WooCommerce woocommerce-google-adwords-conversion-tracking-tag allows Retrieve Embedded Sensitive Data.This issue affects Pixel Manager for Woo…

    alekv Pixel Manager for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2025-67561

    WordPress Debug Log Viewer plugin <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Oleksandr Lysyi Debug Log Viewer debug-log-viewer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Debug Log Viewer: from n/a through <= 2.0.3.

    Oleksandr Lysyi Debug Log Viewer
  • Medium 5.4
    CVE-2025-67562

    WordPress Image Caption Hover Pro plugin < 20.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WebCodingPlace Image Caption Hover Pro image-caption-hover-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Caption Hover Pro: from n/a through < 20.0.

    WebCodingPlace Image Caption Hover Pro
  • Medium 5.4
    CVE-2025-67560

    WordPress Listdom plugin <= 5.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webilia Inc. Listdom listdom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listdom: from n/a through <= 5.0.1.

    Webilia Listdom
  • Medium 5.9
    CVE-2025-67558

    WordPress Rencontre plugin <= 3.13.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacques Malgrange Rencontre rencontre allows Stored XSS.This issue affects Rencontre: from n/a through <= 3.13.7.

    Jacques Malgrange Rencontre
  • Medium 5.4
    CVE-2025-67559

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Online Booking & Scheduling Calendar…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Medium 5.9
    CVE-2025-67555

    WordPress UseStrict's Calendly Embedder plugin <= 1.1.7.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in useStrict UseStrict's Calendly Embedder cal-embedder-lite allows Stored XSS.This issue affects UseStrict's Calendly Embedder: from n/a through <= 1.1.7.2.

    useStrict UseStrict's Calendly Embedder
  • Medium 5.9
    CVE-2025-67556

    WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows Stored XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

    ThemeHigh Advanced FAQ Manager
  • Medium 5.9
    CVE-2025-67557

    WordPress WP eBay Product Feeds plugin <= 3.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rhys Wynne WP eBay Product Feeds ebay-feeds-for-wordpress allows Stored XSS.This issue affects WP eBay Product Feeds: from n/a through <= 3.4.9.

    Rhys Wynne WP eBay Product Feeds
  • Medium 5.9
    CVE-2025-67554

    WordPress Cookie Notice & Compliance for GDPR / CCPA plugin <= 2.5.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Humanityco Cookie Notice & Compliance for GDPR / CCPA cookie-notice allows Stored XSS.This issue affects Cookie Notice & Compliance for GDPR / CCPA: from n/a…

    Hu-manity.co Cookie Notice & Compliance for GDPR / CCPA