Skip to content
OpenAdvisories

Archive

December 2025

Vulnerabilities first published in this month (UTC), newest first.

← November 2025 2025 / December January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

2,174 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-62742

    WordPress Curator.io plugin <= 1.9.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Curator.io Curator.io curatorio allows Stored XSS.This issue affects Curator.io: from n/a through <= 1.9.5.

    Curator.io Curator.io
  • Medium 6.5
    CVE-2025-62118

    WordPress AdWords Conversion Tracking Code plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kcseopro AdWords Conversion Tracking Code adwords-conversion-tracking-code allows Stored XSS.This issue affects AdWords Conversion Tracking Code: from n/a th…

    kcseopro AdWords Conversion Tracking Code
  • Medium 6.5
    CVE-2025-62990

    WordPress Livemesh Addons for Beaver Builder plugin <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in livemesh Livemesh Addons for Beaver Builder addons-for-beaver-builder allows Stored XSS.This issue affects Livemesh Addons for Beaver Builder: from n/a throu…

    Livemesh Livemesh Addons for Beaver Builder
  • Medium 6.5
    CVE-2025-62125

    WordPress Custom Background Changer plugin <= 3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Anshul Gangrade Custom Background Changer custom-background-changer allows Stored XSS.This issue affects Custom Background Changer: from n/a through <= 3.0.

    Anshul Gangrade Custom Background Changer
  • Medium 6.5
    CVE-2025-62743

    WordPress MyBookTable Bookstore plugin <= 3.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zookatron MyBookTable Bookstore mybooktable allows Stored XSS.This issue affects MyBookTable Bookstore: from n/a through <= 3.6.0.

    zookatron MyBookTable Bookstore
  • Medium 6.5
    CVE-2025-62744

    WordPress Page Title Splitter plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Steman Page Title Splitter page-title-splitter allows Stored XSS.This issue affects Page Title Splitter: from n/a through <= 2.5.9.

    Chris Steman Page Title Splitter
  • Medium 6.5
    CVE-2025-62748

    WordPress Web and WooCommerce Addons for WPBakery Builder plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Genetech Products Web and WooCommerce Addons for WPBakery Builder vc-addons-by-bit14 allows DOM-Based XSS.This issue affects Web and WooCommerce Addons for W…

    Genetech Products Web and WooCommerce Addons for WPBakery Builder Web / CMS
  • Medium 6.5
    CVE-2025-49358

    WordPress Content Fetcher plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ruhul Amin Content Fetcher content-fetcher allows DOM-Based XSS.This issue affects Content Fetcher: from n/a through <= 1.1.

    Ruhul Amin Content Fetcher
  • Medium 6.5
    CVE-2025-62749

    WordPress User Specific Content plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bainternet User Specific Content user-specific-content allows DOM-Based XSS.This issue affects User Specific Content: from n/a through <= 1.0.6.

    Bainternet User Specific Content
  • Medium 6.5
    CVE-2025-62752

    WordPress Calendar.online / Kalender.digital plugin <= 1.0.13 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kalender.digital Kalender.digital kalender-digital allows DOM-Based XSS.This issue affects Kalender.digital: from n/a through <= 1.0.13.

    kalender.digital Kalender.digital
  • Medium 6.5
    CVE-2025-62135

    WordPress Responsive Block Control plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in landwire Responsive Block Control responsive-block-control allows DOM-Based XSS.This issue affects Responsive Block Control: from n/a through <= 1.3.0.

    landwire Responsive Block Control
  • Medium 6.5
    CVE-2025-62756

    WordPress The Moneytizer plugin <= 10.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lvaudore The Moneytizer the-moneytizer allows DOM-Based XSS.This issue affects The Moneytizer: from n/a through <= 10.0.9.

    lvaudore The Moneytizer
  • Medium 6.5
    CVE-2025-62757

    WordPress WebMan Amplifier plugin <= 1.5.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WebMan Design | Oliver Juhas WebMan Amplifier webman-amplifier allows DOM-Based XSS.This issue affects WebMan Amplifier: from n/a through <= 1.5.12.

    WebMan Design | Oliver Juhas WebMan Amplifier
  • Medium 6.5
    CVE-2025-62991

    WordPress Minamaze theme <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Minamaze minamaze allows Stored XSS.This issue affects Minamaze: from n/a through <= 1.10.1.

    thinkupthemes Minamaze
  • Medium 6.5
    CVE-2025-63032

    WordPress Consulting theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Consulting consulting allows Stored XSS.This issue affects Consulting: from n/a through <= 1.5.0.

    thinkupthemes Consulting
  • Medium 6.5
    CVE-2025-62136

    WordPress Melos theme <= 1.6.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thinkupthemes Melos melos allows Stored XSS.This issue affects Melos: from n/a through <= 1.6.0.

    thinkupthemes Melos
  • Medium 6.5
    CVE-2025-62992

    WordPress Everest Backup plugin <= 2.3.11 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in everestthemes Everest Backup everest-backup allows Path Traversal.This issue affects Everest Backup: from n/a through <= 2.3.11.

    Everest themes Everest Backup
  • Medium 6.5
    CVE-2025-62137

    WordPress Shuttle theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shuttlethemes Shuttle shuttle allows Stored XSS.This issue affects Shuttle: from n/a through <= 1.5.0.

    shuttlethemes Shuttle
  • Medium 6.5
    CVE-2025-62758

    WordPress Funnelforms Free plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Funnelforms Funnelforms Free funnelforms-free allows DOM-Based XSS.This issue affects Funnelforms Free: from n/a through <= 3.8.

    Funnelforms Funnelforms Free
  • Medium 6.5
    CVE-2025-62759

    WordPress Series plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Series series allows Stored XSS.This issue affects Series: from n/a through <= 2.0.1.

    Justin Tadlock Series
  • Medium 6.5
    CVE-2025-62760

    WordPress BuddyPress Activity Shortcode plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BuddyDev BuddyPress Activity Shortcode bp-activity-shortcode allows Stored XSS.This issue affects BuddyPress Activity Shortcode: from n/a through <= 1.1.8.

    BuddyDev BuddyPress Activity Shortcode
  • Medium 6.5
    CVE-2025-63000

    WordPress Sermon Manager plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Stored XSS.This issue affects Sermon Manager: from n/a through <= 2.30.0.

    wpforchurch Sermon Manager
  • Medium 6.5
    CVE-2025-62146

    WordPress MX Time Zone Clocks plugin <= 5.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maksym Marko MX Time Zone Clocks mx-time-zone-clocks allows Stored XSS.This issue affects MX Time Zone Clocks: from n/a through <= 5.1.1.

    Maksym Marko MX Time Zone Clocks
  • Medium 6.5
    CVE-2025-63005

    WordPress WordPress Tooltips plugin <= 10.9.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomas WordPress Tooltips wordpress-tooltips allows Stored XSS.This issue affects WordPress Tooltips: from n/a through <= 10.9.3.

    Tomas WordPress Tooltips Web / CMS
  • Medium 6.5
    CVE-2025-62761

    WordPress Knowledge Base documentation & wiki plugin – BasePress plugin <= 2.17.0.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BasePress Knowledge Base documentation & wiki plugin – BasePress basepress allows Stored XSS.This issue affects Knowledge Base documentation & wiki plugin – …

    BasePress Knowledge Base documentation & wiki plugin – BasePress
  • Medium 4.3
    CVE-2025-14783 Public exploit

    Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect

    The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient validation on the redirect url supplied via the 'edd_redirect' parameter. This makes it possible for…

    smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Web / CMS
  • Medium 5.3
    CVE-2025-14434

    Ultimate Post Kit < 4.0.16 – Unauthenticated Arbitrary Post Content Disclosure

    The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts without ensuring that posts to be displayed are published authentication. This allows an unauthenticated…

    Web / CMS
  • Medium 4.5
    CVE-2025-69277

    libsodium has Incomplete List of Disallowed Inputs

    libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles checks for whether an elliptic curve point is valid because it sometimes allows points that aren't in the…

    libsodium libsodium airflow-3 datadog-agent-7.72-core-integrations Debian Ubuntu Azure Linux Alpine Wolfi Packagist PyPI
  • Medium 6.3
    CVE-2025-15375

    EyouCMS arcpagelist Ajax.php unserialize deserialization

    A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component arcpagelist Handler. Executing a manipulation of the argument attstr can lead to deserialization. T…

  • Medium 6.3
    CVE-2025-15373

    EyouCMS function.php saveRemote server-side request forgery

    A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation leads to server-side request forgery. It is possible to launch the attack remotely. The exploit has …

  • Medium 4.3
    CVE-2025-15223

    Philipinho Simple-PHP-Blog login.php cross site scripting

    A vulnerability was found in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. Impacted is an unknown function of the file /login.php. Performing manipulation of the argument Username results in cross site scripting. The attack is pos…

    Philipinho Simple-PHP-Blog
  • Medium 5.5
    CVE-2025-68131

    CBORDecoder reuse can leak shareable values across decode calls

    cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5.8.0, whhen a CBORDecoder instance is reused across multiple decode operations, values marked with t…

    agronholm cbor2 cbor2 cbor2 Debian Ubuntu Azure Linux PyPI
  • Medium 6.1
    CVE-2022-50802

    ETAP Safety Manager 1.0.0.32 Unauthenticated Reflected Cross-Site Scripting via Action Parameter

    ETAP Safety Manager 1.0.0.32 contains a cross-site scripting vulnerability in the 'action' GET parameter that allows unauthenticated attackers to inject malicious HTML and JavaScript. Attackers can craft specially formed requests to execute arbitrary scripts …

    ETAP Lighting International NV ETAP Safety Manager
  • Medium 5.4
    CVE-2025-15112

    Ksenia Security lares Home Automation 1.6 URL Redirection Vulnerability

    Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 'redirectPage' GET parameter. Attackers can craft malicious links that redirect authenticated users to …

    Ksenia Security S.p.A. lares
  • Medium 4.3
    CVE-2024-58337

    Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI

    Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized acces…

    The Akuvox Company Akuvox Smart Doorphone Akuvox Smart Intercom
  • Medium 5.3
    CVE-2024-58336

    Akuvox Smart Intercom S539 Unauthenticated Video Stream Disclosure

    Akuvox Smart Intercom S539 contains an unauthenticated vulnerability that allows remote attackers to access live video streams by requesting the video.cgi endpoint on port 8080. Attackers can retrieve video stream data without authentication by directly acces…

    The Akuvox Company Akuvox Smart Doorphone Akuvox Smart Intercom
  • Medium 4.3
    CVE-2022-50801

    JM-DATA ONU JF511-TV 1.0.67 Authenticated Stored Cross-Site Scripting (XSS) Vulnerability

    JM-DATA ONU JF511-TV version 1.0.67 is vulnerable to authenticated stored cross-site scripting (XSS) attacks, allowing attackers with authenticated access to inject malicious scripts that will be executed in other users' browsers when they view the affected c…

    JM-DATA ONU JF511-TV
  • Medium 4.7
    CVE-2025-15360

    newbee-mall-plus Product Information Edit UploadController.java upload unrestricted upload

    A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadController.java of the component Product Information Edit Page. This manipulation of the argument File…

  • Medium 6.3
    CVE-2025-15357

    D-Link DI-7400G+ msp_info.htm command injection

    A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument cmd results in command injection. The attack can be launched remotely. The exploit has been made pu…

    D-Link DI-7400G+ Network devices
  • Medium 5.3
    CVE-2025-14987

    Cross Namespace Commands Authorization Bypass

    When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different n…

    Temporal Technologies temporal go.temporal.io/server Go