Skip to content
OpenAdvisories

Archive

December 2025

Vulnerabilities first published in this month (UTC), newest first.

← November 2025 2025 / December January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

2,174 results · Clear filters · Feed

  • Medium 6.3
    CVE-2025-15390

    PHPGurukul Small CRM edit-user.php authorization

    A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible to launch the attack remotely. The exploit has been released …

    PHPGurukul Small CRM
  • Medium 5.3
    CVE-2025-49334

    WordPress MyD Delivery plugin <= 1.7.1 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Eduardo Villão MyD Delivery myd-delivery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MyD Delivery: from n/a through <= 1.7.1.

    Eduardo Villão MyD Delivery
  • Medium 5.3
    CVE-2025-59136 Scanner template

    WordPress Gerencianet Oficial plugin <= 3.1.3 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Efí Bank Gerencianet Oficial woo-gerencianet-official allows Retrieve Embedded Sensitive Data.This issue affects Gerencianet Oficial: from n/a through <= 3.1.3.

    Efí Bank Gerencianet Oficial
  • Medium 5.3
    CVE-2025-62129

    WordPress RestroPress plugin <= 3.2.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.7.

    magnigenie RestroPress
  • Medium 5.3
    CVE-2025-62092

    WordPress Wiremo plugin <= 1.4.99 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Wiremo Wiremo woo-reviews-by-wiremo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wiremo: from n/a through <= 1.4.99.

    Wiremo Wiremo
  • Medium 5.3
    CVE-2025-62755

    WordPress GS Portfolio for Envato plugin <= 1.4.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in GS Plugins GS Portfolio for Envato gs-envato-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GS Portfolio for Envato: from n/a through <= 1.4.2.

    GS Plugins GS Portfolio for Envato
  • Medium 5.3
    CVE-2025-63031

    WordPress EasyTest – Simplify A/B Testing plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

    WP Grids EasyTest – Simplify A/B Testing
  • Medium 5.3
    CVE-2025-62139

    WordPress Terms descriptions plugin <= 3.4.10 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Vladimir Statsenko Terms descriptions terms-descriptions allows Retrieve Embedded Sensitive Data.This issue affects Terms descriptions: from n/a through <= 3.4.10.

    Vladimir Statsenko Terms descriptions
  • Medium 5.3
    CVE-2025-62141

    WordPress Wawp plugin <= 4.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Information Technology Wawp automation-web-platform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wawp: from n/a through <= 4.4.

    Information Technology Wawp
  • Medium 5.3
    CVE-2025-63022

    WordPress Simple Like Page plugin <= 1.5.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in topdevs.net Simple Like Page simple-facebook-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Like Page: from n/a through <= 1.5.3.

    topdevs.net Simple Like Page
  • Medium 5.3
    CVE-2025-63016

    WordPress QuadLayers TikTok Feed plugin <= 4.6.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in quadlayers QuadLayers TikTok Feed wp-tiktok-feed allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects QuadLayers TikTok Feed: from n/a through <= 4.6.5.

    quadlayers QuadLayers TikTok Feed
  • Medium 5.3
    CVE-2025-62145

    WordPress DMCA Protection Badge plugin <= 2.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NewClarity DMCA Protection Badge dmca-badge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DMCA Protection Badge: from n/a through <= 2.2.0.

    NewClarity DMCA Protection Badge
  • Medium 5.3
    CVE-2025-62147

    WordPress Realbig plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in nikmelnik Realbig realbig-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Realbig: from n/a through <= 1.1.3.

    nikmelnik Realbig
  • Medium 5.3
    CVE-2025-62081

    WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Shopping & Shoppable Videos …

    Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-63053

    WordPress Master Addons for Elementor plugin <= 2.0.9.9.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Liton Arefin Master Addons for Elementor master-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Master Addons for Elementor: from n/a through <…

    Liton Arefin Master Addons for Elementor
  • Medium 5.3
    CVE-2025-63001

    WordPress Hotel Booking plugin <= 3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8.

    nicdark Hotel Booking
  • Medium 5.3
    CVE-2025-49349

    WordPress Reuters Direct plugin <= 3.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Reuters News Agency Reuters Direct reuters-direct allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reuters Direct: from n/a through <= 3.0.0.

    Reuters News Agency Reuters Direct
  • Medium 5.4
    CVE-2025-62098

    WordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.

    Total-Soft Portfolio Gallery
  • Medium 5.4
    CVE-2025-62091

    WordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.8.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generat…

    Vollstart Serial Codes Generator and Validator with WooCommerce Support Web / CMS
  • Medium 5.4
    CVE-2025-62108

    WordPress Add Custom Codes plugin <= 4.80 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Custom Codes: from n/a through <= 4.80.

    SaifuMak Add Custom Codes
  • Medium 5.4
    CVE-2025-62888

    WordPress WP Attachments plugin <= 5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.

    Marco Milesi WP Attachments
  • Medium 5.4
    CVE-2025-62117

    WordPress EasyIndex plugin <= 1.1.1704 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Jayce53 EasyIndex easyindex allows Cross Site Request Forgery.This issue affects EasyIndex: from n/a through <= 1.1.1704.

    jayce53 EasyIndex
  • Medium 5.4
    CVE-2025-62120

    WordPress OpenHook plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Rick Beckman OpenHook thesis-openhook allows Cross Site Request Forgery.This issue affects OpenHook: from n/a through <= 4.3.1.

    Rick Beckman OpenHook
  • Medium 5.4
    CVE-2025-62134

    WordPress Contact Form Widget plugin <= 1.5.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in A WP Life Contact Form Widget new-contact-form-widget allows Cross Site Request Forgery.This issue affects Contact Form Widget: from n/a through <= 1.5.1.

    A WP Life Contact Form Widget
  • Medium 5.4
    CVE-2025-62138

    WordPress WP Advanced PDF plugin <= 1.1.7 - Other vulnerability Type vulnerability

    Missing Authorization vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Advanced PDF: from n/a through <= 1.1.7.

    cedcommerce WP Advanced PDF
  • Medium 5.4
    CVE-2025-62144

    WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mohammed Kaludi Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Core Web Vitals & PageSpeed Booster: from n…

    mohammed_kaludi Core Web Vitals & PageSpeed Booster
  • Medium 5.8
    CVE-2025-59003

    WordPress ColorWay Theme <= 4.2.3 - Sensitive Data Exposure Vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in inkthemescom ColorWay colorway allows Retrieve Embedded Sensitive Data.This issue affects ColorWay: from n/a through <= 4.2.3.

    inkthemescom ColorWay
  • Medium 5.9
    CVE-2025-62119

    WordPress Add Featured Image Custom Link plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ViitorCloud Technologies Pvt Ltd Add Featured Image Custom Link custom-url-to-featured-image allows DOM-Based XSS.This issue affects Add Featured Image Custo…

    ViitorCloud Technologies Pvt Add Featured Image Custom Link
  • Medium 5.9
    CVE-2025-62121

    WordPress Logo Slider , Logo Carousel , Logo showcase , Client Logo plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo tc-logo-slider allows Stored XSS.This issue affects Logo Slider , Logo Carousel , Logo sh…

    Imran Emu Logo Slider , Logo Carousel , Logo showcase , Client Logo
  • Medium 5.9
    CVE-2025-62124

    WordPress WP Post Signature plugin <= 0.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Soli WP Post Signature wp-post-signature allows Stored XSS.This issue affects WP Post Signature: from n/a through <= 0.4.1.

    Soli WP Post Signature
  • Medium 5.9
    CVE-2025-62750

    WordPress WooCommerce Parcelas plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Filipe Seabra WooCommerce Parcelas woocommerce-parcelas allows DOM-Based XSS.This issue affects WooCommerce Parcelas: from n/a through <= 1.3.5.

    Filipe Seabra WooCommerce Parcelas Web / CMS
  • Medium 5.9
    CVE-2025-62140

    WordPress Locatoraid Store Locator plugin <= 3.9.68 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.68.

    plainware Locatoraid Store Locator
  • Medium 5.9
    CVE-2025-62142

    WordPress Post Video Players plugin <= 1.163 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicashmu Post Video Players video-playlist-and-gallery-plugin allows Stored XSS.This issue affects Post Video Players: from n/a through <= 1.163.

    nicashmu Post Video Players
  • Medium 5.9
    CVE-2025-62149

    WordPress Add Custom Codes plugin <= 4.80 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Stored XSS.This issue affects Add Custom Codes: from n/a through <= 4.80.

    SaifuMak Add Custom Codes
  • Medium 6.5
    CVE-2025-62095

    WordPress Bootstrap Modals plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in neilgee Bootstrap Modals bootstrap-modals allows Stored XSS.This issue affects Bootstrap Modals: from n/a through <= 1.3.2.

    Neil Gee Bootstrap Modals
  • Medium 6.5
    CVE-2025-62096

    WordPress Maximum Products per User for WooCommerce plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFactory Maximum Products per User for WooCommerce maximum-products-per-user-for-woocommerce allows Stored XSS.This issue affects Maximum Products per User …

    WPFactory Maximum Products per User for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-62097

    WordPress SEO Slider plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in seothemes SEO Slider seo-slider allows DOM-Based XSS.This issue affects SEO Slider: from n/a through <= 1.1.1.

    seothemes SEO Slider
  • Medium 6.5
    CVE-2025-63020

    WordPress Postie plugin <= 1.9.73 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wayne Allen Postie postie allows Stored XSS.This issue affects Postie: from n/a through <= 1.9.73.

    Wayne Allen Postie
  • Medium 6.5
    CVE-2025-62111

    WordPress Extra Shortcodes plugin <= 2.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webvitaly Extra Shortcodes extra-shortcodes allows Stored XSS.This issue affects Extra Shortcodes: from n/a through <= 2.2.

    webvitaly Extra Shortcodes
  • Medium 6.5
    CVE-2025-49357

    WordPress Audiomack plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in audiomack Audiomack audiomack allows Stored XSS.This issue affects Audiomack: from n/a through <= 1.4.8.

    audiomack Audiomack