CVE-2025-11176

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfisetthumbnail and qfideletethumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated...

PT-2025-42428

Name of the Vulnerable Software and Affected Versions Felan Framework versions up to and including 1.1.4 Description The Felan Framework plugin for WordPress has an authentication issue due to hardcoded passwords in the fb ajax login or register and google ajax login or register functions. This...

CVE-2025-10849: Missing Authorization

The Felan Framework plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'processpluginactions' function called via an AJAX action in versions up to, and including, 1.1.4. This makes it possible for unauthenticated attackers to activate ...

PT-2025-42520

Name of the Vulnerable Software and Affected Versions LibreNMS versions 25.8.0 through 25.10.0 Description LibreNMS contains a flaw in the Alerts Alert Rules page where the alert rule name is not properly sanitized. This allows for the injection of HTML code, potentially leading to Cross-Site...

PT-2025-42427

Name of the Vulnerable Software and Affected Versions Felan Framework plugin for WordPress versions up to and including 1.1.4 Description The Felan Framework plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the process plugin...

CVE-2025-10313

The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the faradminajaxfun function in all versions up to, and including, 1.1. This makes it possible for...

CVE-2025-10299

The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...

CVE-2025-10313 Find And Replace content for WordPress <= 1.1 - Missing Authorization to Unauthenticated Stored Cross-Site Scripting

The Find And Replace content for WordPress plugin for WordPress is vulnerable to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement due to a missing capability check on the faradminajaxfun function in all versions up to, and including, 1.1. This makes it possible for...

CVE-2025-10303

CVE-2025-10303 affects the WordPress Library Management System plugin. The root cause is a missing capability check in owt7_library_management_ajax_handler(), affecting all versions up to 3.1, enabling authenticated users with Subscriber-level access and above to modify various plugin settings. W...

EUVD-2025-34513

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfisetthumbnail and qfideletethumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated...

CVE-2025-11176

CVE-2025-11176 affects the WordPress plugin “Quick Featured Images” (versions up to 13.7.2). The vulnerability is an Insecure Direct Object Reference (IDOR) in the qfi_set_thumbnail and qfi_delete_thumbnail AJAX actions caused by missing validation of a user-controlled key. This allows authentica...

CVE-2025-11176 Quick Featured Images <= 13.7.2 - Insecure Direct Object Reference to Image Manipulation

The Quick Featured Images plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 13.7.2 via the qfisetthumbnail and qfideletethumbnail AJAX actions due to missing validation on a user controlled key. This makes it possible for authenticated...

PT-2025-42295

Name of the Vulnerable Software and Affected Versions Library Management System plugin for WordPress versions prior to 3.2 Description The Library Management System plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the owt7...

WordPress plugin Library Management System 安全漏洞

The WordPress Library Management System plugin is a plugin for extending the functionality of WordPress, mainly used to help users manage website content, user data and system settings more efficiently. The WordPress Library Management System plugin suffers from an unauthorized data modification...

CVE-2025-11196: Exposure of Sensitive Information to an Unauthorized Actor

The External Login plugin for WordPress is vulnerable to sensitive information exposure in all versions up to, and including, 1.11.2 due to the 'exlogtestconnection' AJAX action lacking capability checks or nonce validation. This makes it possible for authenticated attackers, with subscriber-leve...

PT-2025-42298

Name of the Vulnerable Software and Affected Versions Find And Replace content for WordPress plugin versions prior to 1.2 Description The Find And Replace content for WordPress plugin for WordPress is susceptible to unauthorized Stored Cross-Site Scripting and Arbitrary Content Replacement. This ...

PT-2025-42292

Name of the Vulnerable Software and Affected Versions WPBifröst versions through 1.0.7 Description The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress has an issue that allows authenticated attackers with Subscriber-level access or higher to create new administrative...

Exploit for CVE-2025-11171

CVE-2025-11171: Missing Authentication in Chartify WordPress P...

Exploit for CVE-2025-11171

CVE-2025-11171: Missing Authentication in Chartify WordPress Plu...

VulnCheck KEV: CVE-2025-2539

The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers, leveraging the use of a reversible weak algorithm, to read...