Skip to content
OpenAdvisories

Archive

8 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /8 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

79 results · Clear filters · Feed

  • High 7.1
    CVE-2025-67922

    WordPress Grand Restaurant theme < 7.0.9 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a through < 7.0.9.

    ThemeGoods Grand Restaurant
  • High 7.5
    CVE-2025-67925

    WordPress Corpkit theme <= 2.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Corpkit corpkit allows PHP Local File Inclusion.This issue affects Corpkit: from n/a through <= 2.0.

    Zozothemes Corpkit
  • High 8.5
    CVE-2025-67921

    WordPress Lobo theme < 2.8.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue affects Lobo: from n/a through < 2.8.6.

    VanKarWai Lobo
  • High 8.1
    CVE-2025-67920

    WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File Inclusion.This issue affects Neo Ocular: from n/a through < 1.2.

    Elated-Themes Neo Ocular
  • High 7.1
    CVE-2025-67918

    WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through <= 5.4.30.

    WofficeIO Woffice
  • High 8.8
    CVE-2025-67915

    WordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.

    Arraytics Timetics
  • High 7.1
    CVE-2025-67916

    WordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from n/a through <= 4.3.0.

    Astoundify Jobify
  • High 7.7
    CVE-2025-67914

    WordPress VidMov theme <= 2.3.8 - Path Traversal vulnerability

    Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8.

    beeteam368 VidMov
  • High 7.1
    CVE-2025-27004

    WordPress Famous - Responsive Image And Video Grid Gallery WordPress Plugin plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin famous_grid_image_and_video_gallery allows Reflected XSS.This issue affects Fa…

    LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin Web / CMS
  • High 7.1
    CVE-2025-27002

    WordPress CountDown With Image or Video Background plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background countdown-with-background allows Reflected XSS.This issue affects CountDown With Image or Video Backgro…

    LambertGroup CountDown With Image or Video Background
  • High 8.5
    CVE-2025-22728

    WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.

    AmentoTech Workreap (theme's plugin)
  • High 7.5
    CVE-2025-22715

    WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attractive Donations Syste…

    loopus WP Attractive Donations System - Easy Stripe & Paypal donations
  • High 8.1
    CVE-2025-22712

    WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through <= 3.0.2.

    QantumThemes Typify
  • High 8.5
    CVE-2025-22713

    WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from …

    vanquish WooCommerce Orders & Customers Exporter Web / CMS
  • High 7.1
    CVE-2025-22725

    WordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Stored XSS.This issue affects WP Virtual Assistant: from n/a through <= 3.1.

    loopus WP Virtual Assistant
  • High 8.1
    CVE-2025-22707

    WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through <= 2.7.3.

    ThemeMove Moody
  • High 8.1
    CVE-2025-22708

    WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4.

    ThemeMove Mitech
  • High 8.1
    CVE-2025-22509

    WordPress Atlas theme <= 2.1.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMRW-studio Atlas atlas allows PHP Local File Inclusion.This issue affects Atlas: from n/a through <= 2.1.0.

    TMRW-studio Atlas
  • High 8.1
    CVE-2025-14431

    WordPress Navian theme <= 1.5.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4.

    THEMELOGI Navian
  • High 8.1
    CVE-2025-14430

    WordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

    ThemeMove Brook
  • High 7.5
    CVE-2025-14358

    WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: from n/a through <= 19.9.5.

    sizam REHub Framework
  • High 7.5
    CVE-2025-14360

    WordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2.19.

    Kaira Blockons
  • High 8.1
    CVE-2025-14429

    WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through <= 1.6.6.

    ThemeMove AeroLand
  • High 8.1
    CVE-2025-14359

    WordPress Oshine theme < 7.3.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion. This issue affects Oshine: from n/a before 7.3.0.

    Brandexponents Oshine
  • High 7.1
    CVE-2025-13504

    WordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.

    e-plugins Real Estate Pro
  • High 7.1
    CVE-2025-12551

    WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This issue affects ListingHub: from n/a through 1.2.6.

    e-plugins ListingHub
  • High 8.1
    CVE-2025-12549

    WordPress Rozy - Flower Shop theme <= 1.2.25 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allows PHP Local File Inclusion.This issue affects Rozy - Flower Shop: from n/a through <= 1.2.25.

    magentech Rozy - Flower Shop
  • High 8.1
    CVE-2025-12550

    WordPress OchaHouse theme <= 2.2.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows PHP Local File Inclusion.This issue affects OchaHouse: from n/a through <= 2.2.8.

    jwsthemes OchaHouse
  • High 7.3
    CVE-2026-0700

    code-projects Intern Membership Management System check_admin.php sql injection

    A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be …

    code-projects Intern Membership Management System
  • High 7.8
    CVE-2026-21427

    The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which m…

    PIONEER Stellanova APS-S301 series USB DAC Amplifier APS-DA101JGL Stellanova Lite APS-S201JS
  • High 7.5
    CVE-2026-21868

    Flag Forge has ReDoS Vulnerability in User Profile Lookup API

    Flag Forge is a Capture The Flag (CTF) platform. Versions 2.3.2 and below have a Regular Expression Denial of Service (ReDoS) vulnerability in the user profile API endpoint (/api/user/[username]). The application constructs a regular expression dynamically us…

    FlagForgeCTF flagForge
  • High 7.8
    CVE-2026-22035

    Greenshot Vulnerable to OS Command Injection via ExternalCommand Plugin

    Greenshot is an open source Windows screenshot utility. Versions 1.3.310 and below arvulnerable to OS Command Injection through unsanitized filename processing. The FormatArguments method in ExternalCommandDestination.cs:269 uses string.Format() to insert use…

    greenshot greenshot
  • High 7.5
    CVE-2025-50334

    An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting co…

  • High 8.1
    CVE-2025-67089

    A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present…

  • High 8.7
    CVE-2025-63611

    Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint)…

  • High 8.8
    CVE-2025-68719

    KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and mai…

  • High 8.4
    CVE-2025-68716

    KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 enable the SSH service enabled by default on the LAN interface. The ro…

  • High 7.5
    CVE-2025-65518 Public exploit

    Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS) condition. The vulnerability …

  • High 7.5
    CVE-2025-56424

    An issue in Insiders Technologies GmbH e-invoice pro before release 1 Service Pack 2 allows a remote attacker to cause …