CVE-2025-1971: Deserialization of Untrusted Data

The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'formdata' parameter. This makes it possible for authenticated attackers, with Administrator-level acces...

CVE-2025-1973: Improper Limitation of a Pathname to a Restricted Directory

The Export and Import Users and Customers plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.6.2 via the downloadfile function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrar...

PT-2025-12326

Name of the Vulnerable Software and Affected Versions The Order Export & Order Import for WooCommerce plugin for WordPress versions up to, and including, 2.6.0 Description The issue is related to insufficient file path validation in the admin log page function, allowing authenticated attackers wi...

PT-2025-12327

Name of the Vulnerable Software and Affected Versions Order Export & Order Import for WooCommerce plugin for WordPress versions up to, and including, 2.6.0 Description The issue allows authenticated attackers with Administrator-level access and above to make web requests to arbitrary locations...

CVE-2024-13923: Server-Side Request Forgery (SSRF)

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.6.0 via the validatefile function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web...

CVE-2024-13920: Improper Limitation of a Pathname to a Restricted Directory

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.6.0 via the downloadfile function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents ...

PT-2025-12325

Name of the Vulnerable Software and Affected Versions The Order Export & Order Import for WooCommerce plugin for WordPress versions up to, and including, 2.6.0 Description The issue is related to PHP Object Injection via deserialization of untrusted input from the form data parameter. This allows...

CVE-2024-13921: Deserialization of Untrusted Data

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.0 via deserialization of untrusted input from the 'formdata' parameter. This makes it possible for authenticated attackers, with Administrator-level...

PT-2025-11677

Name of the Vulnerable Software and Affected Versions AHAthat Plugin versions up to, and including, 1.6 Description The issue is related to time-based SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing...

CVE-2025-2511: Improper Neutralization of Special Elements used in an SQL Command

The AHAthat Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' parameter in all versions up to, and including, 1.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-11140

Name of the Vulnerable Software and Affected Versions: WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin versions up to, and including, 2.32 Description: The issue allows authenticated attackers with Administrator-level access and above to perform SQL Injectio...

CVE-2025-2250: Improper Neutralization of Special Elements used in an SQL Command

The WordPress Report Brute Force Attacks and Login Protection ReportAttacks Plugins plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 2.32 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2025-2076

The binlayerpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

PT-2025-11303

Name of the Vulnerable Software and Affected Versions: GDPR Cookie Compliance WordPress plugin versions prior to 4.15.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks due to insufficient input sanitization and output escaping of...

CVE-2024-13838: Server-Side Request Forgery (SSRF)

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.2 via the 'callwebhook' method of the AutomatorSendWebhook class This makes it possible for...

PT-2025-10664

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform affected versions not specified Description The issue is related to improper error handling, which reveals technical details of the application in exceptions and stack traces. An attacker wit...

CVE-2025-23185: Generation of Error Message Containing Sensitive Information

Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown to the user and in stack traces. Only an attacker with administrator level privileges has access to this disclosed information, and they...

CVE-2024-13844: Improper Neutralization of Special Elements used in an SQL Command

The Post SMTP plugin for WordPress is vulnerable to generic SQL Injection via the ‘columns’ parameter in all versions up to, and including, 3.1.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-10420

Name of the Vulnerable Software and Affected Versions Post SMTP plugin for WordPress versions up to and including 3.1.2 Description The issue allows authenticated attackers with Administrator-level access and above to perform generic SQL Injection via the columns parameter due to insufficient...

CVE-2024-13835: Improper Privilege Management

The Post Meta Data Manager plugin for WordPress is vulnerable to multisite privilege escalation in all versions up to, and including, 1.4.4. This is due to the plugin not properly verifying the existence of a multisite installation prior to allowing user meta to be added/modified. This makes it...