Skip to content
OpenAdvisories

Archive

16 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /16 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

134 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-68070

    WordPress VK Google Job Posting Manager plugin <= 1.2.22 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-posting-manager allows Stored XSS.This issue affects VK Google Job Posting Manager: from n/a through …

    Vektor VK Google Job Posting Manager
  • Medium 5.4
    CVE-2025-67989

    WordPress Kerge theme <= 4.1.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through <= 4.1.3.

    LMPixels Kerge
  • Medium 6.5
    CVE-2025-67983

    WordPress WP Visitor Statistics (Real Time Traffic) plugin <= 8.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-stats-manager allows DOM-Based XSS.This issue affects WP Visitor Statistics (Real Time Traffic): from …

    osamaesh WP Visitor Statistics (Real Time Traffic)
  • Medium 5.9
    CVE-2025-67986

    WordPress Document Library Lite plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows DOM-Based XSS.This issue affects Document Library Lite: from n/a through <= 1.1.7.

    Barn2 Plugins Document Library Lite
  • Medium 5.3
    CVE-2025-67985

    WordPress Document Library Lite plugin <= 1.1.7 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Document Library Lite: from n/a through <= 1…

    Barn2 Plugins Document Library Lite
  • Medium 6.5
    CVE-2025-67976

    WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.

    Bob Watu Quiz
  • Medium 5.3
    CVE-2025-67965

    WordPress Homey Core plugin <= 2.4.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Homey Core: from n/a through <= 2.4.3.

    Fave Themes Homey Core
  • Medium 4.3
    CVE-2025-67948

    WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-marketing-newsletter allows Retrieve Embedded Sensitive Data.This issue affects SendPulse Email Marketin…

    sendpulse SendPulse Email Marketing Newsletter
  • Medium 5.3
    CVE-2025-67929

    WordPress TI WooCommerce Wishlist plugin <= 2.10.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TI WooCommerce Wishlist: from n/a through <= 2.10.0.

    templateinvaders TI WooCommerce Wishlist Web / CMS
  • Medium 6.5
    CVE-2025-67951

    WordPress WPZOOM Addons for Elementor plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor wpzoom-elementor-addons allows DOM-Based XSS.This issue affects WPZOOM Addons for Elementor: from n/a through <= 1.2.10.

    WPZOOM WPZOOM Addons for Elementor
  • Medium 5.4
    CVE-2025-66167

    WordPress Lottier plugin <= 1.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Lottier lottier-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier: from n/a through <= 1.1.1.

    merkulove Lottier
  • Medium 5.4
    CVE-2025-66165

    WordPress Lottier for WPBakery plugin <= 1.1.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for WPBakery: from n/a through <= 1.1.7.

    merkulove Lottier for WPBakery
  • Medium 5.4
    CVE-2025-66164

    WordPress Laser plugin <= 1.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser: from n/a through <= 1.1.1.

    merkulove Laser
  • Medium 5.4
    CVE-2025-66166

    WordPress Lottier for Elementor plugin <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Lottier for Elementor lottier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lottier for Elementor: from n/a through <= 1.0.9.

    merkulove Lottier for Elementor
  • Medium 6.5
    CVE-2025-67912

    WordPress Stars Testimonials plugin <= 3.3.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-and-masonry-grid allows Stored XSS.This issue affects Stars Testimonials: from n/a through <= 3.3.4.

    Premio Stars Testimonials
  • Medium 5.4
    CVE-2025-66163

    WordPress Masker for Elementor plugin <= 1.1.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Masker for Elementor: from n/a through <= 1.1.4.

    merkulove Masker for Elementor
  • Medium 5.4
    CVE-2025-66162

    WordPress Spoter for Elementor plugin <= 1.04 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spoter for Elementor: from n/a through <= 1.04.

    merkulove Spoter for Elementor
  • Medium 5.4
    CVE-2025-66134

    WordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FileBird Pro: from n/a through <= 6.5.1.

    Ninja Team FileBird Pro
  • Medium 5.4
    CVE-2025-66147

    WordPress Coder for Elementor plugin <= 1.0.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coder for Elementor: from n/a through <= 1.0.13.

    merkulove Coder for Elementor
  • Medium 5.4
    CVE-2025-66161

    WordPress Grider for Elementor plugin <= 1.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Grider for Elementor: from n/a through <= 1.0.8.

    merkulove Grider for Elementor
  • Medium 5.3
    CVE-2025-66130

    WordPress WP Views Counter plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Views Counter: from n/a through <= 2.1.2.

    etruel WP Views Counter
  • Medium 5.3
    CVE-2025-66132

    WordPress FAPI Member plugin <= 2.2.30 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in FAPI Business s.r.o. FAPI Member fapi-member allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAPI Member: from n/a through <= 2.2.30.

    FAPI Business s.r.o. FAPI Member
  • Medium 5.3
    CVE-2025-66133

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy …

    WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
  • Medium 5.3
    CVE-2025-66131

    WordPress Yaad Sarig Payment Gateway For WC plugin <= 2.2.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Yaad Sarig Payment Gateway For WC: from n/a through…

    yaadsarig Yaad Sarig Payment Gateway For WC
  • Medium 5.3
    CVE-2025-66128

    WordPress Sendinblue for WooCommerce plugin <= 4.0.49 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendinblue for WooCommerce: from n/a through <= 4…

    Brevo Sendinblue for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-66127

    WordPress Essential Real Estate plugin <= 5.3.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Real Estate: from n/a through <= 5.3.2.

    G5Theme Essential Real Estate
  • Medium 5.3
    CVE-2025-66126

    WordPress Fix Media Library plugin <= 2.0 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in wowpress.host Fix Media Library wow-media-library-fix allows Retrieve Embedded Sensitive Data.This issue affects Fix Media Library: from n/a through <= 2.0.

    wowpress.host Fix Media Library
  • Medium 5.3
    CVE-2025-66129

    WordPress Pochipp plugin <= 1.18.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pochipp: from n/a through <= 1.18.0.

    wppochipp Pochipp
  • Medium 5.3
    CVE-2025-66125

    WordPress Ultimate Auction plugin <= 4.3.3 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Nitesh Ultimate Auction ultimate-auction allows Retrieve Embedded Sensitive Data.This issue affects Ultimate Auction : from n/a through <= 4.3.3.

    Nitesh Ultimate Auction
  • Medium 5.3
    CVE-2025-66120

    WordPress CatFolders plugin <= 2.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CatFolders: from n/a through <= 2.5.3.

    catfolders CatFolders
  • Medium 5.3
    CVE-2025-66121

    WordPress SiteGround Security plugin <= 1.5.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through <= 1.5.8.

    SiteGround SiteGround Security
  • Medium 5.3
    CVE-2025-66122

    WordPress Stylish Price List plugin <= 7.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stylish Price List: from n/a through <= 7.2.2.

    Design Stylish Price List
  • Medium 5.3
    CVE-2025-66124

    WordPress Leaky Paywall plugin <= 4.22.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Leaky Paywall: from n/a through <= 4.22.6.

    ZEEN101 Leaky Paywall
  • Medium 5.3
    CVE-2025-64639

    WordPress WP Compress for MainWP plugin <= 6.50.17 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress for MainWP: from n/a through <= 6.50.17.

    WP Compress WP Compress for MainWP
  • Medium 5.3
    CVE-2025-64638

    WordPress OnPay.io for WooCommerce plugin <= 1.0.47 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects OnPay.io for WooCommerce: from n/a through <= 1.0.47.

    OnPay.io OnPay.io for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-64635

    WordPress Feeds for YouTube plugin <= 2.4.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Feeds for YouTube: from n/a through <= 2.4.0.

    Syed Balkhi Feeds for YouTube
  • Medium 5.3
    CVE-2025-64634

    WordPress Avada theme <= 7.13.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n/a through <= 7.13.2.

    ThemeFusion Avada
  • Medium 5.3
    CVE-2025-64632

    WordPress Google XML Sitemaps plugin <= 4.1.22 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google XML Sitemaps: from n/a through <= 4.1.22.

    Auctollo Google XML Sitemaps
  • Medium 5.3
    CVE-2025-64633

    WordPress Norebro Extra plugin <= 1.6.8 - Content Injection vulnerability

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This issue affects Norebro Extra: from n/a through <= 1.6.8.

    Colabrio Norebro Extra
  • Medium 4.9
    CVE-2025-64630

    WordPress Business Directory plugin <= 6.4.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Business Directory: from n/a through <= 6.4.19.

    Strategy11 Team Business Directory