Skip to content
OpenAdvisories

Archive

December 2025

Vulnerabilities first published in this month (UTC), newest first.

← November 2025 2025 / December January 2026 →
  1. 1143
  2. 2179
  3. 396
  4. 4170
  5. 5146
  6. 666
  7. 723
  8. 8246
  9. 9672
  10. 10261
  11. 11210
  12. 12230
  13. 1382
  14. 1444
  15. 15149
  16. 16364
  17. 17191
  18. 18399
  19. 19111
  20. 2024
  21. 2130
  22. 22111
  23. 23154
  24. 24494
  25. 2533
  26. 2659
  27. 2715
  28. 2844
  29. 29131
  30. 30428
  31. 31219
All Critical High Medium Low Exploited only Public exploit

2,174 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-69018

    WordPress Web Directory Free plugin <= 1.7.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows DOM-Based XSS.This issue affects Web Directory Free: from n/a through <= 1.7.12.

    Shamalli Web Directory Free
  • Medium 6.5
    CVE-2025-69020

    WordPress Newsletters plugin <= 4.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Stored XSS.This issue affects Newsletters: from n/a through <= 4.12.

    Tribulant Software Newsletters
  • Medium 6.5
    CVE-2025-69017

    WordPress RestroPress plugin <= 3.2.8.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.

    magnigenie RestroPress
  • Medium 4.3
    CVE-2025-69013

    WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.

    jetmonsters Stratum
  • Medium 4.9
    CVE-2025-69014

    WordPress Youzify plugin <= 1.3.7 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.

    Youzify Youzify
  • Medium 4.3
    CVE-2025-69012

    WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.

    Stephen Harris Event Organiser
  • Medium 5.3
    CVE-2025-69010

    WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.

    themebeez Themebeez Toolkit
  • Medium 5.9
    CVE-2025-69007

    WordPress Popping Sidebars and Widgets Light plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Sidebars and Widgets Light popping-sidebars-and-widgets-light allows Stored XSS.This issue affects Popping Sidebars and Widgets Light: from…

    otwthemes Popping Sidebars and Widgets Light
  • Medium 5.9
    CVE-2025-69006

    WordPress AM Events plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atte Moisio AM Events am-events allows Stored XSS.This issue affects AM Events: from n/a through <= 1.13.1.

    Atte Moisio AM Events
  • Medium 5.3
    CVE-2025-69009

    WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.

    kamleshyadav Medicalequipment
  • Medium 5.9
    CVE-2025-69008

    WordPress Inboxify Sign Up Form plugin <= 1.0.4 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Inboxify Inboxify Sign Up Form inboxify-sign-up-form allows Stored XSS.This issue affects Inboxify Sign Up Form: from n/a through <= 1.0.4.

    Inboxify Inboxify Sign Up Form
  • Medium 5.4
    CVE-2025-68998

    WordPress Heateor Social Login plugin <= 1.1.39 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.

    Heateor Support Heateor Social Login
  • Medium 5.3
    CVE-2025-68994

    WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.

    XforWooCommerce Product Loops for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-68995

    WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.

    Premio My Sticky Elements
  • Medium 5.3
    CVE-2025-68997

    WordPress wpDiscuz plugin <= 7.6.43 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in AdvancedCoding wpDiscuz wpdiscuz allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects wpDiscuz: from n/a through <= 7.6.43.

    advancedcoding wpDiscuz
  • Medium 5.3
    CVE-2025-68993

    WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCo…

    XforWooCommerce Share, Print and PDF Products for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68991

    WordPress BWL Pro Voting Manager plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Pro Voting Manager bwl-pro-voting-manager allows DOM-Based XSS.This issue affects BWL Pro Voting Manager: from n/a through <= 1.4.9.

    xenioushk BWL Pro Voting Manager
  • Medium 4.3
    CVE-2025-68989

    WordPress Contact Form 7 Extension For Mailchimp plugin <= 0.9.68 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Renzo Johnson contact-form-7-mailchimp-extension contact-form-7-mailchimp-extension allows Retrieve Embedded Sensitive Data.This issue affects contact-form-7-mailchimp-extension: from n/a thro…

    Renzo Johnson contact-form-7-mailchimp-extension
  • Medium 6.5
    CVE-2025-68992

    WordPress BWL Knowledge Base Manager plugin <= 1.6.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xenioushk BWL Knowledge Base Manager bwl-kb-manager allows Stored XSS.This issue affects BWL Knowledge Base Manager: from n/a through <= 1.6.3.

    xenioushk BWL Knowledge Base Manager
  • Medium 5.3
    CVE-2025-68988

    WordPress E-Invoice App Malaysia plugin <= 1.3.0 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in o2oe E-Invoice App Malaysia einvoiceapp-malaysia allows Retrieve Embedded Sensitive Data.This issue affects E-Invoice App Malaysia: from n/a through <= 1.3.0.

    o2oe E-Invoice App Malaysia
  • Medium 5.3
    CVE-2025-68982

    WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

    Design themes DesignThemes LMS Addon
  • Medium 5.3
    CVE-2025-68981

    WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

    Design themes HomeFix Elementor Portfolio
  • Medium 5.3
    CVE-2025-68979

    WordPress Google Calendar Events plugin <= 3.5.9 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in SimpleCalendar Google Calendar Events google-calendar-events allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Google Calendar Events: from n/a through …

    Simple Calendar Google Calendar Events
  • Medium 5.4
    CVE-2025-68976

    WordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerability

    Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

    Eagle-Themes Eagle Booking
  • Medium 6.5
    CVE-2025-68978

    WordPress DesignThemes Core plugin <= 1.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Core designthemes-core allows DOM-Based XSS.This issue affects DesignThemes Core: from n/a through <= 1.6.

    Design themes DesignThemes Core
  • Medium 5.3
    CVE-2025-68980

    WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

    Design themes WeDesignTech Portfolio
  • Medium 6.5
    CVE-2025-68977

    WordPress DesignThemes Portfolio Addon plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in designthemes DesignThemes Portfolio Addon designthemes-portfolio-addon allows DOM-Based XSS.This issue affects DesignThemes Portfolio Addon: from n/a through…

    Design themes DesignThemes Portfolio Addon
  • Medium 4.3
    CVE-2025-68975

    WordPress Eagle Booking plugin <= 1.3.4.3 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

    Eagle-Themes Eagle Booking
  • Medium 6.6
    CVE-2025-68974

    WordPress WordPress Social Login and Register plugin <= 7.7.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in miniOrange WordPress Social Login and Register miniorange-login-openid allows PHP Local File Inclusion.This issue affects WordPress Social…

    miniOrange WordPress Social Login and Register Web / CMS
  • Medium 6.1
    CVE-2025-15355

    NetVision Information｜ISOinsight - Reflected Cross-site Scripting

    ISOinsight developed by NetVision Information has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript codes in user's browser through phishing attacks.

    NetVision Information ISOinsight
  • Medium 5.3
    CVE-2025-15229

    Tenda CH22 DhcpListClient fromDhcpListClient denial of service

    A vulnerability has been found in Tenda CH22 up to 1.0.0.1. Affected by this vulnerability is the function fromDhcpListClient of the file /goform/DhcpListClient. Such manipulation of the argument LISTLEN leads to denial of service. The attack may be launched …

    Tenda CH22
  • Medium 6.1
    CVE-2025-14313

    Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax

    The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

    Web / CMS
  • Medium 6.1
    CVE-2025-14312

    Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via counter

    The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

    Web / CMS
  • Medium 5.0
    CVE-2025-15222

    Dromara Sa-Token SaSerializerTemplateForJdkUseBase64.java ObjectInputStream.readObject deserialization

    A vulnerability has been found in Dromara Sa-Token up to 1.44.0. This issue affects the function ObjectInputStream.readObject of the file SaSerializerTemplateForJdkUseBase64.java. Such manipulation leads to deserialization. The attack can be executed remotely…

    dromara Sa-Token
  • Medium 4.3
    CVE-2025-15220

    SohuTV CacheCloud LoginController.java init cross site scripting

    A vulnerability was detected in SohuTV CacheCloud up to 3.2.0. This affects the function init of the file src/main/java/com/sohu/cache/web/controller/LoginController.java. The manipulation results in cross site scripting. The attack may be launched remotely. …

    SohuTV CacheCloud
  • Medium 4.3
    CVE-2025-15213

    code-projects Student File Management System File Download download.php improper authorization

    A vulnerability has been found in code-projects Student File Management System 1.0. The affected element is an unknown function of the file /download.php of the component File Download Handler. The manipulation of the argument store_id leads to improper autho…

    code-projects Student File Management System
  • Medium 6.3
    CVE-2025-15212

    code-projects Refugee Food Management System regfood.php sql injection

    A vulnerability was detected in code-projects Refugee Food Management System 1.0. This issue affects some unknown processing of the file /home/regfood.php. Performing manipulation of the argument a results in sql injection. Remote exploitation of the attack i…

    code-projects Refugee Food Management System
  • Medium 6.3
    CVE-2025-15211

    code-projects Refugee Food Management System refugee.php sql injection

    A flaw has been found in code-projects Refugee Food Management System 1.0. Impacted is an unknown function of the file /home/refugee.php. Executing manipulation of the argument refNo/Fname/Lname/sex/age/contact/nationality_nid can lead to sql injection. The a…

    code-projects Refugee Food Management System
  • Medium 6.5
    CVE-2025-65925 Public exploit

    An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts t…

  • Medium 5.4
    CVE-2025-68120

    Unexpected untrusted code execution in github.com/golang/vscode-go

    To prevent unexpected untrusted code execution, the Visual Studio Code Go extension is now disabled in Restricted Mode.

    github.com/golang/vscode-go github.com/golang/vscode-go github.com/golang/vscode-go Go