Skip to content
OpenAdvisories

Archive

24 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /24 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

109 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-68595

    WordPress Widgets for Social Photo Feed plugin <= 1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Trustindex Widgets for Social Photo Feed social-photo-feed-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Widgets for Social Photo Feed: from n/a through <= 1.8.

    trustindex Widgets for Social Photo Feed
  • Medium 5.3
    CVE-2025-68589

    WordPress WP Telegram Widget and Join Link plugin <= 2.2.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Socio WP Telegram Widget and Join Link wptelegram-widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Telegram Widget and Join Link: from n/a through <= 2.2.12.

    WP Socio WP Telegram Widget and Join Link
  • Medium 5.4
    CVE-2025-68591

    WordPress Simple File List plugin <= 6.1.18 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mitchell Bennis Simple File List simple-file-list allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple File List: from n/a through <= 6.1.18.

    Mitchell Bennis Simple File List
  • Medium 4.3
    CVE-2025-68592

    WordPress WP Adminify plugin <= 4.0.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Liton Arefin WP Adminify adminify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Adminify: from n/a through <= 4.0.6.1.

    Liton Arefin WP Adminify
  • Medium 5.3
    CVE-2025-68586

    WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.

    Gora Tech Cooked
  • Medium 4.3
    CVE-2025-68587

    WordPress Watu Quiz plugin <= 3.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz: from n/a through <= 3.4.5.

    Bob Watu Quiz
  • Medium 4.3
    CVE-2025-68588

    WordPress TS Poll plugin <= 2.5.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in totalsoft TS Poll poll-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TS Poll: from n/a through <= 2.5.5.

    Total-Soft TS Poll
  • Medium 4.3
    CVE-2025-68583

    WordPress Fast User Switching plugin <= 1.4.10 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Tikweb Management Fast User Switching fast-user-switching allows Cross Site Request Forgery.This issue affects Fast User Switching: from n/a through <= 1.4.10.

    Tikweb Management Fast User Switching
  • Medium 4.3
    CVE-2025-68584

    WordPress Vimeotheque plugin <= 2.3.5.2 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Constantin Boiangiu Vimeotheque codeflavors-vimeo-video-post-lite allows Cross Site Request Forgery.This issue affects Vimeotheque: from n/a through <= 2.3.5.2.

    Constantin Boiangiu Vimeotheque
  • Medium 4.3
    CVE-2025-68580

    WordPress Advanced Classifieds & Directory Pro plugin <= 3.2.9 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in pluginsware Advanced Classifieds & Directory Pro advanced-classifieds-and-directory-pro allows Cross Site Request Forgery.This issue affects Advanced Classifieds & Directory Pro: from n/a through <= 3.2.9.

    pluginsware Advanced Classifieds & Directory Pro
  • Medium 5.4
    CVE-2025-68581

    WordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.

    YITHEMES YITH Slider for page builders
  • Medium 5.3
    CVE-2025-68582

    WordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Funnelforms Free: from n/a through <= 3.8.

    Funnelforms Funnelforms Free
  • Medium 5.3
    CVE-2025-68579

    WordPress FV Simpler SEO plugin <= 1.9.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Simpler SEO: from n/a through <= 1.9.6.

    foliovision FV Simpler SEO
  • Medium 5.3
    CVE-2025-68578

    WordPress Addonify plugin <= 2.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Addonify Addonify addonify-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify: from n/a through <= 2.0.4.

    Addonify Addonify
  • Medium 4.3
    CVE-2025-68577

    WordPress Virusdie plugin <= 1.1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.

    virusdie Virusdie
  • Medium 4.3
    CVE-2025-68576

    WordPress Virusdie plugin <= 1.1.6 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.

    virusdie Virusdie
  • Medium 5.9
    CVE-2025-68574

    WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements:…

    VOID CODERS WPBakery Visual Composer WHMCS Elements
  • Medium 5.3
    CVE-2025-68575

    WordPress Wappointment plugin <= 2.7.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through <= 2.7.6.

    Wappointment team Wappointment
  • Medium 5.3
    CVE-2025-68572

    WordPress BBP Core plugin <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BBP Core: from n/a through <= 1.4.1.

    Spider Themes BBP Core
  • Medium 5.3
    CVE-2025-68571

    WordPress SALESmanago plugin <= 3.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.9.0.

    SALESmanago SALESmanago & Leadoo
  • Medium 5.4
    CVE-2025-68573

    WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.

    Alessandro Piconi Simple Keyword to Link
  • Medium 5.4
    CVE-2025-68567

    WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue affects My auctions allegro: from n/a through <= 3.6.33.

    wphocus My auctions allegro
  • Medium 5.3
    CVE-2025-68568

    WordPress Claspo – Popups, Spin the Wheel & Email Capture plugin <= 1.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: fro…

    Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture
  • Medium 6.5
    CVE-2025-68569

    WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.39.

    codepeople WP Time Slots Booking Form
  • Medium 5.9
    CVE-2025-68566

    WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.

    wphocus My auctions allegro
  • Medium 5.3
    CVE-2025-68565

    WordPress Twitch Player plugin <= 2.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in JayBee Twitch Player ttv-easy-embed-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Twitch Player: from n/a through <= 2.1.3.

    JayBee Twitch Player
  • Medium 5.9
    CVE-2025-67633

    WordPress Greenhouse Job Board plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brownbagmarketing Greenhouse Job Board greenhouse-job-board allows DOM-Based XSS.This issue affects Greenhouse Job Board: from n/a through <= 2.7.3.

    brownbagmarketing Greenhouse Job Board
  • Medium 5.9
    CVE-2025-67632

    WordPress Google AdSense for Responsive Design – GARD plugin <= 2.23 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design – GARD google-adsense-for-responsive-design-gard allows DOM-Based XSS.This issue affects Google AdSen…

    The Plugin Factory Google AdSense for Responsive Design – GARD
  • Medium 5.9
    CVE-2025-67630

    WordPress WH Tweaks plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WH Tweaks wh-tweaks allows Stored XSS.This issue affects WH Tweaks: from n/a through <= 1.0.2.

    webheadcoder WH Tweaks
  • Medium 5.9
    CVE-2025-67628

    WordPress Review Disclaimer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AMP-MODE Review Disclaimer review-disclaimer allows Stored XSS.This issue affects Review Disclaimer: from n/a through <= 2.0.3.

    AMP-MODE Review Disclaimer
  • Medium 5.9
    CVE-2025-67629

    WordPress Basticom Framework plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basticom Basticom Framework basticom-framework allows Stored XSS.This issue affects Basticom Framework: from n/a through <= 1.5.2.

    Basticom Basticom Framework
  • Medium 5.9
    CVE-2025-67631

    WordPress Gift Hunt plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecommerce Platforms Gift Hunt gift-hunt allows Stored XSS.This issue affects Gift Hunt: from n/a through <= 2.0.2.

    Ecommerce Platforms Gift Hunt
  • Medium 5.4
    CVE-2025-67623

    WordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.22.0.

    6Storage 6Storage Rentals
  • Medium 4.3
    CVE-2025-67625

    WordPress Trade Runner plugin <= 3.14 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: from n/a through <= 3.14.

    tmtraderunner Trade Runner
  • Medium 5.9
    CVE-2025-67627

    WordPress Draft Notify plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TouchOfTech Draft Notify draft-notify allows Stored XSS.This issue affects Draft Notify: from n/a through <= 1.5.

    TouchOfTech Draft Notify
  • Medium 4.3
    CVE-2025-67621

    WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a thr…

    10up Eight Day Week Print Workflow workflow Ubuntu
  • Medium 6.5
    CVE-2023-40679

    WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through 2.0.5.3.

    Jewel Theme Master Addons for Elementor
  • Medium 5.9
    CVE-2023-32120

    WordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bob Hostel allows DOM-Based XSS.This issue affects Hostel: from n/a through 1.1.5.1.

    Bob Hostel
  • Medium 4.3
    CVE-2023-28619

    WordPress Resoto theme <= 1.0.8 - Broken Access Control to Arbitrary Plugin Activation

    Missing Authorization vulnerability in bnayawpguy Resoto allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Resoto: from n/a through 1.0.8.

    bnayawpguy Resoto
  • Medium 4.3
    CVE-2025-68535

    WordPress Sunshine Photo Cart plugin <= 3.5.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.

    sunshinephotocart Sunshine Photo Cart