Skip to content
OpenAdvisories

Archive

30 December 2025

Vulnerabilities first published on this day (UTC), newest first.

← November 2025 2025 / December /30 January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

87 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-69030

    WordPress Backpack Traveler theme <= 2.10.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Backpack Traveler backpacktraveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Backpack Traveler: from n/a through <= 2.10.3.

    Mikado-Themes Backpack Traveler
  • Medium 5.4
    CVE-2025-69022

    WordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.

    Weblizar – WordPress Themes & Plugin HR Management Lite
  • Medium 4.3
    CVE-2025-69023

    WordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.

    Marketing Fire Discussion Board
  • Medium 5.4
    CVE-2025-69021

    WordPress Popup box plugin <= 6.0.7 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Popup box ays-popup-box allows Cross Site Request Forgery.This issue affects Popup box: from n/a through <= 6.0.7.

    Ays Pro Popup box
  • Medium 4.3
    CVE-2025-69025

    WordPress Poptics plugin <= 1.0.20 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Aethonic Poptics poptics allows Retrieve Embedded Sensitive Data.This issue affects Poptics: from n/a through <= 1.0.20.

    Aethonic Poptics
  • Medium 6.5
    CVE-2025-69024

    WordPress BizPrint plugin <= 4.6.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.

    bizswoop BizPrint
  • Medium 4.3
    CVE-2025-69016

    WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a t…

    Averta Shortcodes and extra features for Phlox theme
  • Medium 6.5
    CVE-2025-69019

    WordPress FlippingBook plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FlippingBook FlippingBook flippingbook allows DOM-Based XSS.This issue affects FlippingBook: from n/a through <= 2.0.1.

    FlippingBook FlippingBook
  • Medium 6.5
    CVE-2025-69018

    WordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.

    Shamalli Web Directory Free
  • Medium 6.5
    CVE-2025-69020

    WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.

    Tribulant Software Newsletters
  • Medium 6.5
    CVE-2025-69017

    WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.

    magnigenie RestroPress
  • Medium 4.3
    CVE-2025-69013

    WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.

    jetmonsters Stratum
  • Medium 4.9
    CVE-2025-69014

    WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.

    Youzify Youzify
  • Medium 4.3
    CVE-2025-69012

    WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.

    Stephen Harris Event Organiser
  • Medium 5.3
    CVE-2025-69010

    WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.

    themebeez Themebeez Toolkit
  • Medium 5.9
    CVE-2025-69007

    WordPress Popping Sidebars and Widgets Light plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Stored XSS.This issue affects Popping Sidebars and Widgets Light: from…

    otwthemes Popping Sidebars and Widgets Light
  • Medium 5.9
    CVE-2025-69006

    WordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This issue affects AM Events: from n/a through <= 1.13.1.

    Atte Moisio AM Events
  • Medium 5.3
    CVE-2025-69009

    WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.

    kamleshyadav Medicalequipment
  • Medium 5.9
    CVE-2025-69008

    WordPress Inboxify Sign Up Form plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allows Stored XSS.This issue affects Inboxify Sign Up Form: from n/a through <= 1.0.4.

    Inboxify Inboxify Sign Up Form
  • Medium 5.4
    CVE-2025-68998

    WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.

    Heateor Support Heateor Social Login
  • Medium 5.3
    CVE-2025-68994

    WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.

    XforWooCommerce Product Loops for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-68995

    WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.

    Premio My Sticky Elements
  • Medium 5.3
    CVE-2025-68997

    WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.

    advancedcoding wpDiscuz
  • Medium 5.3
    CVE-2025-68993

    WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCo…

    XforWooCommerce Share, Print and PDF Products for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68991

    WordPress BWL Pro Voting Manager plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

    xenioushk BWL Pro Voting Manager
  • Medium 4.3
    CVE-2025-68989

    WordPress Contact Form 7 Extension For Mailchimp plugin <= 0.9.68 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a thro…

    Renzo Johnson contact-form-7-mailchimp-extension
  • Medium 6.5
    CVE-2025-68992

    WordPress BWL Knowledge Base Manager plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allows Stored XSS.This issue affects BWL Knowledge Base Manager: from n/a through <= 1.6.3.

    xenioushk BWL Knowledge Base Manager
  • Medium 5.3
    CVE-2025-68988

    WordPress E-Invoice App Malaysia plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.

    o2oe E-Invoice App Malaysia
  • Medium 5.3
    CVE-2025-68982

    WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

    Design themes DesignThemes LMS Addon
  • Medium 5.3
    CVE-2025-68981

    WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

    Design themes HomeFix Elementor Portfolio
  • Medium 5.3
    CVE-2025-68979

    WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Calendar Events: from n/a through …

    Simple Calendar Google Calendar Events
  • Medium 5.4
    CVE-2025-68976

    WordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerability

    Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

    Eagle-Themes Eagle Booking
  • Medium 6.5
    CVE-2025-68978

    WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.

    Design themes DesignThemes Core
  • Medium 5.3
    CVE-2025-68980

    WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

    Design themes WeDesignTech Portfolio
  • Medium 6.5
    CVE-2025-68977

    WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through…

    Design themes DesignThemes Portfolio Addon
  • Medium 4.3
    CVE-2025-68975

    WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

    Eagle-Themes Eagle Booking
  • Medium 6.6
    CVE-2025-68974

    WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social…

    miniOrange WordPress Social Login and Register Web / CMS
  • Medium 6.1
    CVE-2025-15355

    NetVision Information｜ISOinsight - Reflected Cross-site Scripting

    ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

    NetVision Information ISOinsight
  • Medium 5.3
    CVE-2025-15229

    Tenda CH22 DhcpListClient fromDhcpListClient denial of service

    A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClient. Such manipulation of the argument LISTLEN leads to denial of service. The attack may be launched …

    Tenda CH22
  • Medium 6.1
    CVE-2025-14313

    Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax

    The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

    Web / CMS