Skip to content
OpenAdvisories

Archive

January 2026

Vulnerabilities first published in this month (UTC), newest first.

← December 2025 2026 / January February 2026 →
  1. 135
  2. 2103
  3. 310
  4. 49
  5. 5154
  6. 6185
  7. 7225
  8. 8196
  9. 9127
  10. 1074
  11. 1113
  12. 1286
  13. 13444
  14. 14181
  15. 15201
  16. 16144
  17. 1739
  18. 1829
  19. 19113
  20. 20233
  21. 21123
  22. 22444
  23. 23256
  24. 2465
  25. 2532
  26. 26119
  27. 27197
  28. 28206
  29. 29122
  30. 30121
  31. 3145
All Critical High Medium Low Exploited only Public exploit

1,804 results · Clear filters · Feed

  • Medium 4.3
    CVE-2026-22360

    WordPress SearchAzon plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in AA-Team SearchAzon searchazon allows Cross Site Request Forgery.This issue affects SearchAzon: from n/a through <= 1.4.

    AA-Team SearchAzon
  • Medium 6.5
    CVE-2026-22349

    WordPress Menu In Post plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in linux4me2 Menu In Post menu-in-post allows DOM-Based XSS.This issue affects Menu In Post: from n/a through <= 1.4.1.

    linux4me2 Menu In Post
  • Medium 6.5
    CVE-2026-22347

    WordPress Carousel Horizontal Posts Content Slider plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in subhansanjaya Carousel Horizontal Posts Content Slider carousel-horizontal-posts-content-slider allows DOM-Based XSS.This issue affects Carousel Horizontal P…

    subhansanjaya Carousel Horizontal Posts Content Slider
  • Medium 6.5
    CVE-2026-22353

    WordPress teachPress plugin <= 9.0.12 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in winkm89 teachPress teachpress allows Stored XSS.This issue affects teachPress: from n/a through <= 9.0.12.

    winkm89 teachPress
  • Medium 5.4
    CVE-2026-22358

    WordPress Electrician - Electrical Service WordPress theme <= 5.6 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in SmartDataSoft Electrician - Electrical Service WordPress electrician allows Server Side Request Forgery.This issue affects Electrician - Electrical Service WordPress: from n/a through <= 5.6.

    SmartDataSoft Electrician - Electrical Service WordPress Web / CMS
  • Medium 5.3
    CVE-2026-22348

    WordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Civic Cookie Control: from n/a through <= 1.53.

    Tasos Fel Civic Cookie Control
  • Medium 6.5
    CVE-2025-69315

    WordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.15.

    N Squared Simply Schedule Appointments
  • Medium 5.4
    CVE-2025-69300

    WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability

    Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.63.

    leap13 Premium Addons for Elementor
  • Medium 6.5
    CVE-2025-69095

    WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability

    Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.

    Design themes Reservation Plugin
  • Medium 6.5
    CVE-2025-69055

    WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through < 3.16.3.3.

    SeaTheme BM Content Builder
  • Medium 5.3
    CVE-2025-69001

    WordPress FluentForm plugin <= 6.1.11 - Arbitrary Shortcode Execution vulnerability

    Improper Control of Generation of Code ('Code Injection') vulnerability in Shahjahan Jewel FluentForm fluentform allows Code Injection.This issue affects FluentForm: from n/a through <= 6.1.11.

    Shahjahan Jewel FluentForm
  • Medium 6.5
    CVE-2025-68911

    WordPress Solace theme <= 2.1.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in solacewp Solace solace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Solace: from n/a through <= 2.1.16.

    solacewp Solace
  • Medium 6.5
    CVE-2025-68900

    WordPress Enfold theme <= 7.1.3 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kriesi Enfold allows DOM-Based XSS. This issue affects Enfold: from n/a through 7.1.3.

    Kriesi Enfold
  • Medium 5.8
    CVE-2025-68898

    WordPress Synergy Project Manager plugin <= 1.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cjjparadoxmax Synergy Project Manager synergy-project-manager allows Stored XSS.This issue affects Synergy Project Manager: from n/a through <= 1.5.

    cjjparadoxmax Synergy Project Manager
  • Medium 6.5
    CVE-2025-68896

    WordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One Page Docs: from n/a through <= 1.2.4.

    vrpr WDV One Page Docs
  • Medium 6.5
    CVE-2025-68558

    WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4.

    Averta Depicter Slider
  • Medium 6.5
    CVE-2025-68073

    WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.

    Ninja Team GDPR CCPA Compliance Support
  • Medium 6.5
    CVE-2025-68507

    WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.

    Icegram Icegram
  • Medium 6.5
    CVE-2025-68072

    WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.

    Merv Barrett Easy Property Listings
  • Medium 6.5
    CVE-2025-68046

    WordPress Contact Form & Lead Form Elementor Builder plugin <= 2.0.1 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder lead-form-builder allows Retrieve Embedded Sensitive Data.This issue affects Contact Form & Lead Form Elementor Bu…

    ThemeHunk Contact Form & Lead Form Elementor Builder
  • Medium 6.5
    CVE-2025-68039

    WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.1.0.

    Chris Simmons WP BackItUp
  • Medium 6.5
    CVE-2025-68020

    WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.13.

    WANotifier Notifier
  • Medium 6.5
    CVE-2025-68019

    WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.

    Clever plugins SEO Booster
  • Medium 6.5
    CVE-2025-68016

    WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability

    Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooComm…

    Onepay Sri Lanka onepay Payment Gateway For WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68013

    WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooC…

    cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68009

    WordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.

    Codeless Slider Templates
  • Medium 6.5
    CVE-2025-68007

    WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerability

    Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.

    Event Espresso Event Espresso 4 Decaf
  • Medium 6.5
    CVE-2025-68006

    WordPress Booking Ultra Pro plugin <= 1.1.23 - Sensitive Data Exposure vulnerability

    Insertion of Sensitive Information Into Sent Data vulnerability in Deetronix Booking Ultra Pro booking-ultra-pro allows Retrieve Embedded Sensitive Data.This issue affects Booking Ultra Pro: from n/a through <= 1.1.23.

    Deetronix Booking Ultra Pro
  • Medium 6.5
    CVE-2025-68003

    WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability

    Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.

    renatoatshown Shown Connector
  • Medium 6.4
    CVE-2025-67961

    WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability

    Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0.

    Marco van Wieren WPO365
  • Medium 6.5
    CVE-2025-67958

    WordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.

    Taxcloud TaxCloud for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-67954

    WordPress Salon booking system plugin <= 10.30.3 - Sensitive Data Exposure vulnerability

    Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Retrieve Embedded Sensitive Data.This issue affects Salon booking system: from n/a through <= 10.30.3.

    Dimitri Grassi Salon booking system
  • Medium 6.5
    CVE-2025-67939

    WordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.2.

    Tickera Tickera
  • Medium 6.5
    CVE-2025-67942

    WordPress Peach Payments Gateway plugin <= 3.3.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.

    Peach Payments Peach Payments Gateway
  • Medium 4.3
    CVE-2025-67626

    WordPress WP SEO Search plugin <= 1.1 - Cross Site Request Forgery (CSRF) vulnerability

    Cross-Site Request Forgery (CSRF) vulnerability in Angel Costa WP SEO Search wp-seo-search allows Cross Site Request Forgery.This issue affects WP SEO Search: from n/a through <= 1.1.

    Angel Costa WP SEO Search
  • Medium 5.4
    CVE-2025-66142

    WordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.

    merkulove Comparimager for Elementor
  • Medium 5.4
    CVE-2025-66140

    WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.

    merkulove Uper for Elementor
  • Medium 5.4
    CVE-2025-66139

    WordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.

    merkulove Audier For Elementor
  • Medium 5.4
    CVE-2025-66141

    WordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2.

    merkulove Scroller
  • Medium 5.4
    CVE-2025-66143

    WordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10.

    merkulove Crumber