Skip to content
OpenAdvisories

Archive

9 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /9 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

287 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-67553

    WordPress Advanced FAQ Manager plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHigh Advanced FAQ Manager advanced-faq-manager allows DOM-Based XSS.This issue affects Advanced FAQ Manager: from n/a through <= 1.5.2.

    ThemeHigh Advanced FAQ Manager
  • Medium 6.5
    CVE-2025-67551

    WordPress Wappointment plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wappointment team Wappointment wappointment allows Stored XSS.This issue affects Wappointment: from n/a through <= 2.6.9.

    Wappointment team Wappointment
  • Medium 6.5
    CVE-2025-67552

    WordPress Walker Core plugin <= 1.3.17 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WalkerWP Walker Core walker-core allows DOM-Based XSS.This issue affects Walker Core: from n/a through <= 1.3.17.

    WalkerWP Walker Core
  • Medium 6.5
    CVE-2025-67545

    WordPress FireBox plugin <= 3.1.0-free - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FirePlugins FireBox firebox allows Stored XSS.This issue affects FireBox: from n/a through <= 3.1.0-free.

    fireplugins FireBox
  • Medium 6.5
    CVE-2025-67550

    WordPress Donation Thermometer plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rhewlif Donation Thermometer donation-thermometer allows Stored XSS.This issue affects Donation Thermometer: from n/a through <= 2.2.6.

    rhewlif Donation Thermometer
  • Medium 6.5
    CVE-2025-67548

    WordPress WP Delicious plugin <= 1.9.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Delicious WP Delicious delicious-recipes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Delicious: from n/a through <= 1.9.1.

    WP Delicious WP Delicious
  • Medium 6.5
    CVE-2025-67549

    WordPress oik plugin <= 4.15.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bobbingwide oik oik allows DOM-Based XSS.This issue affects oik: from n/a through <= 4.15.3.

    bobbingwide oik
  • Medium 6.5
    CVE-2025-67544

    WordPress Shopkeeper Extender plugin < 7.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Get Bowtied Shopkeeper Extender shopkeeper-extender allows Stored XSS.This issue affects Shopkeeper Extender: from n/a through < 7.0.

    Get Bowtied Shopkeeper Extender
  • Medium 6.5
    CVE-2025-67543

    WordPress Essential Widgets plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Catch Themes Essential Widgets essential-widgets allows Stored XSS.This issue affects Essential Widgets: from n/a through <= 2.2.2.

    Catch Themes Essential Widgets
  • Medium 6.5
    CVE-2025-67542

    WordPress Multi-Step Checkout for WooCommerce plugin <= 2.33 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SilkyPress Multi-Step Checkout for WooCommerce wp-multi-step-checkout allows DOM-Based XSS.This issue affects Multi-Step Checkout for WooCommerce: from n/a t…

    SilkyPress Multi-Step Checkout for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-67541

    WordPress WP-ShowHide plugin <= 1.05 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Lester Chan WP-ShowHide wp-showhide allows Stored XSS.This issue affects WP-ShowHide: from n/a through <= 1.05.

    Lester Chan WP-ShowHide
  • Medium 6.5
    CVE-2025-67540

    WordPress Animation Addons for Elementor plugin <= 2.4.5 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in Wealcoder Animation Addons for Elementor animation-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Animation Addons for Elementor: from n/a through <= 2.4.5.

    wealcoder Animation Addons for Elementor
  • Medium 6.5
    CVE-2025-67536

    WordPress LearnPress plugin <= 4.2.9.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThimPress LearnPress learnpress allows Stored XSS.This issue affects LearnPress: from n/a through <= 4.2.9.4.

    ThimPress LearnPress
  • Medium 6.5
    CVE-2025-67539

    WordPress Select Core plugin < 2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Select Core select-core allows DOM-Based XSS.This issue affects Select Core: from n/a through < 2.6.

    Select-Themes Select Core
  • Medium 6.5
    CVE-2025-67538

    WordPress JNews Gallery plugin < 12.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jegtheme JNews Gallery jnews-gallery allows Stored XSS.This issue affects JNews Gallery: from n/a through < 12.0.1.

    jegtheme JNews Gallery
  • Medium 6.5
    CVE-2025-67537

    WordPress ThirstyAffiliates plugin <= 3.11.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Blair Williams ThirstyAffiliates thirstyaffiliates allows Stored XSS.This issue affects ThirstyAffiliates: from n/a through <= 3.11.8.

    Blair Williams ThirstyAffiliates
  • Medium 6.6
    CVE-2025-67535

    WordPress WP Maps plugin <= 4.8.6 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.

    Flipper Code – WordPress Development Company WP Maps
  • Medium 4.3
    CVE-2025-67474

    WordPress ForumWP plugin <= 2.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ultimate Member ForumWP forumwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ForumWP: from n/a through <= 2.1.4.

    Ultimate Member ForumWP
  • Medium 4.3
    CVE-2025-67472

    WordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.5.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in vcita Online Booking & Scheduling Calendar for WordPress by vcita meeting-scheduler-by-vcita allows Cross Site Request Forgery.This issue affects Online Booking & Scheduling Calendar for WordPress by vcita: f…

    vcita Online Booking & Scheduling Calendar for WordPress by vcita Web / CMS
  • Medium 4.3
    CVE-2025-67470

    WordPress Portfolio and Projects plugin <= 1.5.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Essential Plugin Portfolio and Projects portfolio-and-projects allows Retrieve Embedded Sensitive Data.This issue affects Portfolio and Projects: from n/a through <= 1…

    Essential Plugin Portfolio and Projects
  • Medium 4.3
    CVE-2025-67473

    WordPress CWW Companion plugin <= 1.3.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in codeworkweb CWW Companion cww-companion allows Cross Site Request Forgery.This issue affects CWW Companion: from n/a through <= 1.3.2.

    codeworkweb CWW Companion
  • Medium 4.3
    CVE-2025-67471

    WordPress Quick Contact Form plugin <= 8.2.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal Quick Contact Form quick-contact-form allows Cross Site Request Forgery.This issue affects Quick Contact Form: from n/a through <= 8.2.5.

    Saad Iqbal Quick Contact Form
  • Medium 4.3
    CVE-2025-67465

    WordPress Simple Link Directory plugin <= 8.8.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Cross Site Request Forgery.This issue affects Simple Link Directory: from n/a through <= 8.8.3.

    Quantum Cloud Simple Link Directory
  • Medium 4.3
    CVE-2025-67469

    WordPress PDF Thumbnail Generator plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in kubiq PDF Thumbnail Generator pdf-thumbnail-generator allows Cross Site Request Forgery.This issue affects PDF Thumbnail Generator: from n/a through <= 1.4.

    kubiq PDF Thumbnail Generator
  • Medium 4.3
    CVE-2025-67468

    WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms cf7-salesforce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Integration f…

    CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms
  • Medium 4.3
    CVE-2025-67466

    WordPress Trinity Audio plugin <= 5.23.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sergiotrinity Trinity Audio trinity-audio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Trinity Audio: from n/a through <= 5.23.3.

    sergiotrinity Trinity Audio
  • Medium 4.3
    CVE-2025-66534

    WordPress The Aisle theme <= 2.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elated-Themes The Aisle theaisle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Aisle: from n/a through <= 2.9.

    Elated-Themes The Aisle
  • Medium 4.3
    CVE-2025-66532

    WordPress Powerlift theme < 3.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mikado-Themes Powerlift powerlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Powerlift: from n/a through < 3.2.1.

    Mikado-Themes Powerlift
  • Medium 4.3
    CVE-2025-66531

    WordPress Salon booking system plugin <= 10.30.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Cross Site Request Forgery.This issue affects Salon booking system: from n/a through <= 10.30.3.

    Dimitri Grassi Salon booking system
  • Medium 4.3
    CVE-2025-66529

    WordPress Chartify plugin <= 3.6.3 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Chartify chart-builder allows Cross Site Request Forgery.This issue affects Chartify: from n/a through <= 3.6.3.

    Ays Pro Chartify
  • Medium 4.3
    CVE-2025-66527

    WordPress Lobo theme <= 2.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VanKarWai Lobo lobo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lobo: from n/a through <= 2.8.6.

    VanKarWai Lobo
  • Medium 4.3
    CVE-2025-66526

    WordPress Tablesome plugin <= 1.1.34 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Essekia Tablesome tablesome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tablesome: from n/a through <= 1.1.34.

    Essekia Tablesome
  • Medium 4.3
    CVE-2025-66528

    WordPress Thank You Page Customizer for WooCommerce plugin <= 1.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in VillaTheme Thank You Page Customizer for WooCommerce woo-thank-you-page-customizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Thank You Page Customizer for WooCommerce: fro…

    villatheme Thank You Page Customizer for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-66530

    WordPress Webba Booking plugin <= 6.2.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through <= 6.2.1.

    Webba Appointment Booking Webba Booking
  • Medium 4.3
    CVE-2025-66525

    WordPress Elastic Email Sender plugin <= 1.2.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Elastic Email Elastic Email Sender elastic-email-sender allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elastic Email Sender: from n/a through <= 1.2.20.

    Elastic Email Elastic Email Sender
  • Medium 4.3
    CVE-2025-64257

    WordPress My Tickets plugin <= 2.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Joe Dolson My Tickets my-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Tickets: from n/a through <= 2.1.0.

    Joe Dolson My Tickets
  • Medium 4.3
    CVE-2025-64256

    WordPress Simple Folio plugin <= 1.1.0 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Folio simple-folio allows Cross Site Request Forgery.This issue affects Simple Folio: from n/a through <= 1.1.0.

    PressTigers Simple Folio
  • Medium 4.3
    CVE-2025-12558

    Beaver Builder – WordPress Page Builder <= 2.9.4 - Authenticated (Contributor+) Sensitive Information Exposure

    The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4 via the 'get_attachment_sizes' function. This makes it possible for authenticated attackers, with Cont…

    Beaver Builder Beaver Builder Page Builder – Drag and Drop Website Builder Web / CMS
  • Medium 5.3
    CVE-2025-10876

    XSS in Talent Software's e-Bap

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Cross-Site Scripting (XSS). This issue affects e-BAP Automation: from 1.8.96 before v.41815.

    Talent Software e-BAP Automation
  • Medium 6.1
    CVE-2025-12381

    Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer

    Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation, Parameter Injection. A local user with access to the command line may escalate their privileges by abusing the parameters of a command that …

    Algosec Firewall Analyzer