Skip to content
OpenAdvisories

Archive

8 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /8 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

196 results · Feed

  • High 8.1
    CVE-2025-67920

    WordPress Neo Ocular theme < 1.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Neo Ocular neoocular allows PHP Local File Inclusion.This issue affects Neo Ocular: from n/a through < 1.2.

    Elated-Themes Neo Ocular
  • Medium 6.5
    CVE-2025-67919

    WordPress Woffice Core plugin <= 5.4.30 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Woffice Core: from n/a through <= 5.4.30.

    WofficeIO Woffice Core
  • Medium 6.5
    CVE-2025-67917

    WordPress Traveler theme <= 3.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Traveler: from n/a through <= 3.2.6.

    shinetheme Traveler
  • High 7.1
    CVE-2025-67918

    WordPress Woffice theme <= 5.4.30 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue affects Woffice: from n/a through <= 5.4.30.

    WofficeIO Woffice
  • High 8.8
    CVE-2025-67915

    WordPress Timetics plugin <= 1.0.46 - Broken Authentication vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.

    Arraytics Timetics
  • High 7.1
    CVE-2025-67916

    WordPress Jobify theme <= 4.3.0 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue affects Jobify: from n/a through <= 4.3.0.

    Astoundify Jobify
  • Medium 6.5
    CVE-2025-67913

    WordPress Aruba HiSpeed Cache plugin < 3.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Aruba HiSpeed Cache: from n/a through < 3.0.3.

    Aruba.it Dev Aruba HiSpeed Cache Network devices
  • Critical 9.1
    CVE-2025-67910

    WordPress Contentstudio plugin <= 1.3.7 - Arbitrary File Upload vulnerability

    Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue affects Contentstudio: from n/a through <= 1.3.7.

    contentstudio Contentstudio
  • High 7.7
    CVE-2025-67914

    WordPress VidMov theme <= 2.3.8 - Path Traversal vulnerability

    Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8.

    beeteam368 VidMov
  • Critical 9.8
    CVE-2025-67911

    WordPress Newsletters plugin <= 4.11 - PHP Object Injection vulnerability

    Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from n/a through <= 4.11.

    Tribulant Software Newsletters
  • High 7.1
    CVE-2025-27004

    WordPress Famous - Responsive Image And Video Grid Gallery WordPress Plugin plugin <= 1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin famous_grid_image_and_video_gallery allows Reflected XSS.This issue affects Fa…

    LambertGroup Famous - Responsive Image And Video Grid Gallery WordPress Plugin Web / CMS
  • High 7.1
    CVE-2025-27002

    WordPress CountDown With Image or Video Background plugin <= 1.5 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background countdown-with-background allows Reflected XSS.This issue affects CountDown With Image or Video Backgro…

    LambertGroup CountDown With Image or Video Background
  • Critical 9.3
    CVE-2025-23993

    WordPress Felan Framework plugin <= 1.1.3 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Injection.This issue affects Felan Framework: from n/a through <= 1.1.3.

    RiceTheme Felan Framework
  • Critical 9.8
    CVE-2025-23504

    WordPress Felan Framework plugin <= 1.1.3 - Account Takeover vulnerability

    Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affects Felan Framework: from n/a through <= 1.1.3.

    RiceTheme Felan Framework
  • Medium 6.4
    CVE-2025-22726

    WordPress nK Themes Helper plugin <= 1.7.9 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in _nK nK Themes Helper nk-themes-helper allows Server Side Request Forgery.This issue affects nK Themes Helper: from n/a through <= 1.7.9.

    nK nK Themes Helper
  • High 8.5
    CVE-2025-22728

    WordPress Workreap (theme's plugin) plugin <= 3.3.6 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL Injection.This issue affects Workreap (theme's plugin): from n/a through <= 3.3.6.

    AmentoTech Workreap (theme's plugin)
  • High 7.5
    CVE-2025-22715

    WordPress WP Attractive Donations System - Easy Stripe & Paypal donations plugin <= 1.25 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attractive Donations Syste…

    loopus WP Attractive Donations System - Easy Stripe & Paypal donations
  • High 8.1
    CVE-2025-22712

    WordPress Typify theme <= 3.0.2 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP Local File Inclusion.This issue affects Typify: from n/a through <= 3.0.2.

    QantumThemes Typify
  • High 8.5
    CVE-2025-22713

    WordPress WooCommerce Orders & Customers Exporter plugin <= 5.4 - SQL Injection vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows SQL Injection.This issue affects WooCommerce Orders & Customers Exporter: from …

    vanquish WooCommerce Orders & Customers Exporter Web / CMS
  • High 7.1
    CVE-2025-22725

    WordPress WP Virtual Assistant plugin <= 3.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Stored XSS.This issue affects WP Virtual Assistant: from n/a through <= 3.1.

    loopus WP Virtual Assistant
  • High 8.1
    CVE-2025-22707

    WordPress Moody theme <= 2.7.3 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Local File Inclusion.This issue affects Moody: from n/a through <= 2.7.3.

    ThemeMove Moody
  • High 8.1
    CVE-2025-22708

    WordPress Mitech theme <= 2.3.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Local File Inclusion.This issue affects Mitech: from n/a through <= 2.3.4.

    ThemeMove Mitech
  • High 8.1
    CVE-2025-22509

    WordPress Atlas theme <= 2.1.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMRW-studio Atlas atlas allows PHP Local File Inclusion.This issue affects Atlas: from n/a through <= 2.1.0.

    TMRW-studio Atlas
  • High 8.1
    CVE-2025-14431

    WordPress Navian theme <= 1.5.4 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Local File Inclusion.This issue affects Navian: from n/a through <= 1.5.4.

    THEMELOGI Navian
  • High 8.1
    CVE-2025-14430

    WordPress Brook - Agency Business Creative theme <= 2.9.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through <= 2.9.0.

    ThemeMove Brook
  • High 7.5
    CVE-2025-14358

    WordPress REHub Framework plugin <= 19.9.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects REHub Framework: from n/a through <= 19.9.5.

    sizam REHub Framework
  • High 7.5
    CVE-2025-14360

    WordPress Blockons plugin <= 1.2.19 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: from n/a through <= 1.2.19.

    Kaira Blockons
  • High 8.1
    CVE-2025-14429

    WordPress AeroLand theme <= 1.6.6 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP Local File Inclusion.This issue affects AeroLand: from n/a through <= 1.6.6.

    ThemeMove AeroLand
  • High 8.1
    CVE-2025-14359

    WordPress Oshine theme < 7.3.0 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local File Inclusion. This issue affects Oshine: from n/a before 7.3.0.

    Brandexponents Oshine
  • High 7.1
    CVE-2025-13504

    WordPress Real Estate Pro plugin <= 2.1.4 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflected XSS.This issue affects Real Estate Pro: from n/a through <= 2.1.4.

    e-plugins Real Estate Pro
  • High 7.1
    CVE-2025-12551

    WordPress ListingHub plugin 1.2.6 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This issue affects ListingHub: from n/a through 1.2.6.

    e-plugins ListingHub
  • High 8.1
    CVE-2025-12549

    WordPress Rozy - Flower Shop theme <= 1.2.25 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allows PHP Local File Inclusion.This issue affects Rozy - Flower Shop: from n/a through <= 1.2.25.

    magentech Rozy - Flower Shop
  • High 8.1
    CVE-2025-12550

    WordPress OchaHouse theme <= 2.2.8 - Local File Inclusion vulnerability

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows PHP Local File Inclusion.This issue affects OchaHouse: from n/a through <= 2.2.8.

    jwsthemes OchaHouse
  • Medium 4.7
    CVE-2026-0701

    code-projects Intern Membership Management System add_admin.php sql injection

    A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /intern/admin/add_admin.php. The manipulation of the argument Username leads to sql injection. The …

    code-projects Intern Membership Management System
  • Medium 6.5
    CVE-2025-13679

    Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details

    The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_order_by_id() function in all versions up to, and including, 3.9.3. This makes it possible for …

    Themeum Tutor LMS – eLearning and online course solution Web / CMS
  • High 7.3
    CVE-2026-0700

    code-projects Intern Membership Management System check_admin.php sql injection

    A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be …

    code-projects Intern Membership Management System
  • Medium 4.7
    CVE-2026-0699

    code-projects Intern Membership Management System edit_activity.php sql injection

    A vulnerability was found in code-projects Intern Membership Management System 1.0. This impacts an unknown function of the file /intern/admin/edit_activity.php. Performing a manipulation of the argument activity_id results in sql injection. Remote exploitati…

    code-projects Intern Membership Management System
  • Medium 4.7
    CVE-2026-0698

    code-projects Intern Membership Management System edit_students.php sql injection

    A vulnerability has been found in code-projects Intern Membership Management System 1.0. This affects an unknown function of the file /intern/admin/edit_students.php. Such manipulation of the argument admin_id leads to sql injection. The attack may be launche…

    code-projects Intern Membership Management System
  • Medium 4.7
    CVE-2026-0697

    code-projects Intern Membership Management System edit_admin.php sql injection

    A flaw has been found in code-projects Intern Membership Management System 1.0. The impacted element is an unknown function of the file /intern/admin/edit_admin.php. This manipulation of the argument admin_id causes sql injection. The attack may be initiated …

    code-projects Intern Membership Management System
  • High 7.8
    CVE-2026-21427

    The installers for multiple products provided by PIONEER CORPORATION contain an issue with the DLL search path, which m…

    PIONEER Stellanova Lite APS-S201JGL Stellanova Limited APS-S202J-LM USB DAC Amplifier APS-DA101JR