Skip to content
OpenAdvisories

Archive

December 2025

Vulnerabilities first published in this month (UTC), newest first.

← November 2025 2025 / December January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

2,174 results · Clear filters · Feed

  • Medium 5.4
    CVE-2025-68581

    WordPress YITH Slider for page builders plugin <= 1.0.11 - Broken Access Control vulnerability

    Missing Authorization vulnerability in YITHEMES YITH Slider for page builders yith-slider-for-page-builders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YITH Slider for page builders: from n/a through <= 1.0.11.

    YITHEMES YITH Slider for page builders
  • Medium 5.3
    CVE-2025-68582

    WordPress Funnelforms Free plugin <= 3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Funnelforms Funnelforms Free funnelforms-free allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Funnelforms Free: from n/a through <= 3.8.

    Funnelforms Funnelforms Free
  • Medium 5.3
    CVE-2025-68579

    WordPress FV Simpler SEO plugin <= 1.9.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in FolioVision FV Simpler SEO fv-all-in-one-seo-pack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FV Simpler SEO: from n/a through <= 1.9.6.

    foliovision FV Simpler SEO
  • Medium 5.3
    CVE-2025-68578

    WordPress Addonify plugin <= 2.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Addonify Addonify addonify-quick-view allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Addonify: from n/a through <= 2.0.4.

    Addonify Addonify
  • Medium 4.3
    CVE-2025-68577

    WordPress Virusdie plugin <= 1.1.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Virusdie Virusdie virusdie allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virusdie: from n/a through <= 1.1.6.

    virusdie Virusdie
  • Medium 4.3
    CVE-2025-68576

    WordPress Virusdie plugin <= 1.1.6 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Virusdie Virusdie virusdie allows Retrieve Embedded Sensitive Data.This issue affects Virusdie: from n/a through <= 1.1.6.

    virusdie Virusdie
  • Medium 5.9
    CVE-2025-68574

    WordPress WPBakery Visual Composer WHMCS Elements plugin <= 1.0.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidcoders WPBakery Visual Composer WHMCS Elements void-visual-whmcs-element allows DOM-Based XSS.This issue affects WPBakery Visual Composer WHMCS Elements:…

    VOID CODERS WPBakery Visual Composer WHMCS Elements
  • Medium 5.3
    CVE-2025-68575

    WordPress Wappointment plugin <= 2.7.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Wappointment team Wappointment wappointment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wappointment: from n/a through <= 2.7.6.

    Wappointment team Wappointment
  • Medium 5.3
    CVE-2025-68572

    WordPress BBP Core plugin <= 1.4.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Spider Themes BBP Core bbp-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BBP Core: from n/a through <= 1.4.1.

    Spider Themes BBP Core
  • Medium 5.3
    CVE-2025-68571

    WordPress SALESmanago plugin <= 3.9.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through <= 3.9.0.

    SALESmanago SALESmanago & Leadoo
  • Medium 5.4
    CVE-2025-68573

    WordPress Simple Keyword to Link plugin <= 1.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Simple Keyword to Link simple-keyword-to-link allows Cross Site Request Forgery.This issue affects Simple Keyword to Link: from n/a through <= 1.5.

    Alessandro Piconi Simple Keyword to Link
  • Medium 5.4
    CVE-2025-68567

    WordPress My auctions allegro plugin <= 3.6.33 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Cross Site Request Forgery.This issue affects My auctions allegro: from n/a through <= 3.6.33.

    wphocus My auctions allegro
  • Medium 5.3
    CVE-2025-68568

    WordPress Claspo – Popups, Spin the Wheel & Email Capture plugin <= 1.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture claspo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Claspo – Popups, Spin the Wheel & Email Capture: fro…

    Claspo Popup Builders Claspo – Popups, Spin the Wheel & Email Capture
  • Medium 6.5
    CVE-2025-68569

    WordPress WP Time Slots Booking Form plugin <= 1.2.39 - Broken Access Control vulnerability

    Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Time Slots Booking Form: from n/a through <= 1.2.39.

    codepeople WP Time Slots Booking Form
  • Medium 5.9
    CVE-2025-68566

    WordPress My auctions allegro plugin <= 3.6.35 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Stored XSS.This issue affects My auctions allegro: from n/a through <= 3.6.35.

    wphocus My auctions allegro
  • Medium 5.3
    CVE-2025-68565

    WordPress Twitch Player plugin <= 2.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in JayBee Twitch Player ttv-easy-embed-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Twitch Player: from n/a through <= 2.1.3.

    JayBee Twitch Player
  • Medium 5.9
    CVE-2025-67633

    WordPress Greenhouse Job Board plugin <= 2.7.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brownbagmarketing Greenhouse Job Board greenhouse-job-board allows DOM-Based XSS.This issue affects Greenhouse Job Board: from n/a through <= 2.7.3.

    brownbagmarketing Greenhouse Job Board
  • Medium 5.9
    CVE-2025-67632

    WordPress Google AdSense for Responsive Design – GARD plugin <= 2.23 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in The Plugin Factory Google AdSense for Responsive Design – GARD google-adsense-for-responsive-design-gard allows DOM-Based XSS.This issue affects Google AdSen…

    The Plugin Factory Google AdSense for Responsive Design – GARD
  • Medium 5.9
    CVE-2025-67630

    WordPress WH Tweaks plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webheadcoder WH Tweaks wh-tweaks allows Stored XSS.This issue affects WH Tweaks: from n/a through <= 1.0.2.

    webheadcoder WH Tweaks
  • Medium 5.9
    CVE-2025-67628

    WordPress Review Disclaimer plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AMP-MODE Review Disclaimer review-disclaimer allows Stored XSS.This issue affects Review Disclaimer: from n/a through <= 2.0.3.

    AMP-MODE Review Disclaimer
  • Medium 5.9
    CVE-2025-67629

    WordPress Basticom Framework plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basticom Basticom Framework basticom-framework allows Stored XSS.This issue affects Basticom Framework: from n/a through <= 1.5.2.

    Basticom Basticom Framework
  • Medium 5.9
    CVE-2025-67631

    WordPress Gift Hunt plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ecommerce Platforms Gift Hunt gift-hunt allows Stored XSS.This issue affects Gift Hunt: from n/a through <= 2.0.2.

    Ecommerce Platforms Gift Hunt
  • Medium 5.4
    CVE-2025-67623

    WordPress 6Storage Rentals plugin <= 2.22.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.22.0.

    6Storage 6Storage Rentals
  • Medium 4.3
    CVE-2025-67625

    WordPress Trade Runner plugin <= 3.14 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in tmtraderunner Trade Runner traderunner allows Cross Site Request Forgery.This issue affects Trade Runner: from n/a through <= 3.14.

    tmtraderunner Trade Runner
  • Medium 5.9
    CVE-2025-67627

    WordPress Draft Notify plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TouchOfTech Draft Notify draft-notify allows Stored XSS.This issue affects Draft Notify: from n/a through <= 1.5.

    TouchOfTech Draft Notify
  • Medium 4.3
    CVE-2025-67621

    WordPress Eight Day Week Print Workflow plugin <= 1.2.5 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in 10up Eight Day Week Print Workflow eight-day-week-print-workflow allows Retrieve Embedded Sensitive Data.This issue affects Eight Day Week Print Workflow: from n/a thr…

    10up Eight Day Week Print Workflow workflow Ubuntu
  • Medium 6.5
    CVE-2023-40679

    WordPress Master Elementor Addons plugin <= 2.0.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through 2.0.5.3.

    Jewel Theme Master Addons for Elementor
  • Medium 5.9
    CVE-2023-32120

    WordPress Hostel plugin <= 1.1.5.1 - Cross Site Scripting (XSS)

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Bob Hostel allows DOM-Based XSS.This issue affects Hostel: from n/a through 1.1.5.1.

    Bob Hostel
  • Medium 4.3
    CVE-2023-28619

    WordPress Resoto theme <= 1.0.8 - Broken Access Control to Arbitrary Plugin Activation

    Missing Authorization vulnerability in bnayawpguy Resoto allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Resoto: from n/a through 1.0.8.

    bnayawpguy Resoto
  • Medium 4.3
    CVE-2025-68535

    WordPress Sunshine Photo Cart plugin <= 3.5.7.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.1.

    sunshinephotocart Sunshine Photo Cart
  • Medium 6.5
    CVE-2025-68533

    WordPress WC Builder plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HasThemes WC Builder wc-builder allows Stored XSS.This issue affects WC Builder: from n/a through <= 1.2.0.

    HasThemes WC Builder
  • Medium 6.5
    CVE-2025-68532

    WordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in modeltheme ModelTheme Addons for WPBakery and Elementor modeltheme-addons-for-wpbakery allows Stored XSS.This issue affects ModelTheme Addons for WPBakery an…

    modeltheme ModelTheme Addons for WPBakery and Elementor
  • Medium 4.3
    CVE-2025-68529

    WordPress WP Email Capture plugin <= 3.12.5 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Cross Site Request Forgery.This issue affects WP Email Capture: from n/a through <= 3.12.5.

    Rhys Wynne WP Email Capture
  • Medium 6.5
    CVE-2025-68528

    WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce amount-left-free-shipping-woocommerce allows Stored XSS.This issue affects Free Sh…

    WPFactory Free Shipping Bar: Amount Left for Free Shipping for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68527

    WordPress Academy LMS plugin <= 3.4.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC Academy LMS academy allows Stored XSS.This issue affects Academy LMS: from n/a through <= 3.4.0.

    kodezen Academy LMS
  • Medium 5.9
    CVE-2025-68525

    WordPress Category Icon plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Category Icon category-icon allows Stored XSS.This issue affects Category Icon: from n/a through <= 1.0.2.

    pixelgrade Category Icon
  • Medium 4.3
    CVE-2025-68523

    WordPress Spiffy Calendar plugin <= 5.0.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Spiffy Calendar: from n/a through <= 5.0.7.

    Spiffy Plugins Spiffy Calendar
  • Medium 5.3
    CVE-2025-68521

    WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.

    wpstream WpStream
  • Medium 4.3
    CVE-2025-68522

    WordPress WpStream plugin <= 4.9.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpstream WpStream wpstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpStream: from n/a through <= 4.9.5.

    wpstream WpStream
  • Medium 6.5
    CVE-2025-68513

    WordPress Bold Timeline Lite plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in boldthemes Bold Timeline Lite bold-timeline-lite allows Stored XSS.This issue affects Bold Timeline Lite: from n/a through <= 1.2.7.

    Bold Themes Bold Timeline Lite