Skip to content
OpenAdvisories

Archive

22 January 2026

Vulnerabilities first published on this day (UTC), newest first.

← December 2025 2026 / January /22 February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

166 results · Clear filters · Feed

  • Medium 6.5
    CVE-2025-68900

    WordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS. This issue affects Enfold: from n/a through 7.1.3.

    Kriesi Enfold
  • Medium 5.8
    CVE-2025-68898

    WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through <= 1.5.

    cjjparadoxmax Synergy Project Manager
  • Medium 6.5
    CVE-2025-68896

    WordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One Page Docs: from n/a through <= 1.2.4.

    vrpr WDV One Page Docs
  • Medium 6.5
    CVE-2025-68558

    WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4.

    Averta Depicter Slider
  • Medium 6.5
    CVE-2025-68073

    WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.

    Ninja Team GDPR CCPA Compliance Support
  • Medium 6.5
    CVE-2025-68507

    WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.

    Icegram Icegram
  • Medium 6.5
    CVE-2025-68072

    WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.

    Merv Barrett Easy Property Listings
  • Medium 6.5
    CVE-2025-68046

    WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Bu…

    ThemeHunk Contact Form & Lead Form Elementor Builder
  • Medium 6.5
    CVE-2025-68039

    WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.1.0.

    Chris Simmons WP BackItUp
  • Medium 6.5
    CVE-2025-68020

    WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.13.

    WANotifier Notifier
  • Medium 6.5
    CVE-2025-68019

    WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.

    Clever plugins SEO Booster
  • Medium 6.5
    CVE-2025-68016

    WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability

    Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooComm…

    Onepay Sri Lanka onepay Payment Gateway For WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68013

    WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooC…

    cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68009

    WordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.

    Codeless Slider Templates
  • Medium 6.5
    CVE-2025-68007

    WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerability

    Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.

    Event Espresso Event Espresso 4 Decaf
  • Medium 6.5
    CVE-2025-68006

    WordPress Booking Ultra Pro plugin <= 1.1.23 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23.

    Deetronix Booking Ultra Pro
  • Medium 6.5
    CVE-2025-68003

    WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability

    Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.

    renatoatshown Shown Connector
  • Medium 6.4
    CVE-2025-67961

    WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0.

    Marco van Wieren WPO365
  • Medium 6.5
    CVE-2025-67958

    WordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.

    Taxcloud TaxCloud for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-67954

    WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.

    Dimitri Grassi Salon booking system
  • Medium 6.5
    CVE-2025-67939

    WordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.2.

    Tickera Tickera
  • Medium 6.5
    CVE-2025-67942

    WordPress Peach Payments Gateway plugin <= 3.3.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.

    Peach Payments Peach Payments Gateway
  • Medium 4.3
    CVE-2025-67626

    WordPress WP SEO Search plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search: from n/a through <= 1.1.

    Angel Costa WP SEO Search
  • Medium 5.4
    CVE-2025-66142

    WordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.

    merkulove Comparimager for Elementor
  • Medium 5.4
    CVE-2025-66140

    WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.

    merkulove Uper for Elementor
  • Medium 5.4
    CVE-2025-66139

    WordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.

    merkulove Audier For Elementor
  • Medium 5.4
    CVE-2025-66141

    WordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2.

    merkulove Scroller
  • Medium 5.4
    CVE-2025-66143

    WordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10.

    merkulove Crumber
  • Medium 5.4
    CVE-2025-66138

    WordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.

    merkulove Motionger for Elementor
  • Medium 5.4
    CVE-2025-66136

    WordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.

    merkulove Carter for Elementor
  • Medium 5.4
    CVE-2025-66137

    WordPress Searcher for Elementor plugin <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.

    merkulove Searcher for Elementor
  • Medium 5.4
    CVE-2025-66135

    WordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.

    merkulove Imager for Elementor
  • Medium 4.9
    CVE-2025-64252

    WordPress ANAC XML Viewer plugin <= 1.8.2 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Marco Milesi ANAC XML Viewer anac-xml-viewer allows Server Side Request Forgery.This issue affects ANAC XML Viewer: from n/a through <= 1.8.2.

    Marco Milesi ANAC XML Viewer
  • Medium 5.3
    CVE-2025-63019

    WordPress Cookies and Content Security Policy plugin <= 2.34 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Johan Jonk Stenström Cookies and Content Security Policy cookies-and-content-security-policy allows Retrieve Embedded Sensitive Data.This issue affects Cookies and Content Security Policy: fro…

    Johan Jonk Stenström Cookies and Content Security Policy
  • Medium 4.3
    CVE-2025-63018

    WordPress Bard theme <= 2.229 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wproyal Bard bard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bard: from n/a through <= 2.229.

    WP Royal Bard
  • Medium 6.5
    CVE-2025-63026

    WordPress Grand Restaurant Theme Elements for Elementor plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant Theme Elements for Elementor grandrestaurant-elementor allows Stored XSS.This issue affects Grand Restaurant Theme Elements for E…

    ThemeGoods Grand Restaurant Theme Elements for Elementor
  • Medium 4.3
    CVE-2025-63051

    WordPress REHub Framework plugin < 19.9.9.4 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in sizam REHub Framework rehub-framework allows Retrieve Embedded Sensitive Data.This issue affects REHub Framework: from n/a through < 19.9.9.4.

    sizam REHub Framework
  • Medium 5.4
    CVE-2025-62106

    WordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5.

    Mario Peshev WP-CRM System
  • Medium 5.3
    CVE-2025-62754

    WordPress Payment Gateway bKash for WC plugin <= 3.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.

    Kapil Paul Payment Gateway bKash for WC
  • Medium 5.4
    CVE-2025-62741

    WordPress Pool Services theme <= 3.3 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Pool Services pool-services allows Server Side Request Forgery.This issue affects Pool Services: from n/a through <= 3.3.

    SmartDataSoft Pool Services