CVE-2024-13450: Server-Side Request Forgery (SSRF)

The Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.17.4 via the Webhooks integration. This makes it possible for...

CVE-2024-12885: Improper Limitation of a Pathname to a Restricted Directory

The Connections Business Directory plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path validation when deleting a connections image directory in all versions up to, and including, 10.4.66. This makes it possible for authenticated attackers, with...

PT-2025-2178

Name of the Vulnerable Software and Affected Versions The Contact Form by Bit Form plugin for WordPress versions up to and including 2.17.4 Description The issue is related to Server-Side Request Forgery, which can be exploited via the Webhooks integration. This allows authenticated attackers wit...

PT-2025-3949

Name of the Vulnerable Software and Affected Versions Podlove Podcast Publisher plugin for WordPress version = 4.1.25 Description The issue is related to Stored Cross-Site Scripting via the Feed Name value due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2025-0554: Improper Neutralization of Input During Web Page Generation

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version = 4.1.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject...

PT-2025-1776

Name of the Vulnerable Software and Affected Versions RSS Icon Widget plugin for WordPress versions up to, and including, 5.2 Description The issue is related to Stored Cross-Site Scripting via the link color parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-12203: Improper Neutralization of Input During Web Page Generation

The RSS Icon Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘linkcolor’ parameter in all versions up to, and including, 5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2024-12045: Improper Neutralization of Input During Web Page Generation

The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the maker title value of the Google Maps block in all versions up to, and including, 5.0.9 due to insufficient input sanitization and output escaping...

CVE-2024-12207: Improper Neutralization of Input During Web Page Generation

The Toggles Shortcode and Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 1.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-12875: External Control of File Name or Path

The Easy Digital Downloads – eCommerce Payments and Subscriptions made easy plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.3.2 via the file download functionality. This makes it possible for authenticated attackers, with Administrator-level acces...

CVE-2024-9624

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

PT-2024-39725

Name of the Vulnerable Software and Affected Versions WP All Import Pro plugin for WordPress versions up to, and including, 4.9.3 Description The issue is related to Server-Side Request Forgery due to missing SSRF protection on the pmxi curl download function. This allows authenticated attackers...

CVE-2024-9624: Server-Side Request Forgery (SSRF)

The WP All Import Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.9.3 due to missing SSRF protection on the pmxicurldownload function. This makes it possible for authenticated attackers, with Administrator-level access and above, to ma...

CVE-2024-9698 Crafthemes Demo Import <= 3.3 - Authenticated (Admin+) Arbitrary File Upload in process_uploaded_files

The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'processuploadedfiles' function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Administrator-level access and...

PT-2024-17679

Name of the Vulnerable Software and Affected Versions bodi0's Easy cache plugin for WordPress versions up to, and including, 0.8 Description The vulnerability is a Stored Cross-Site Scripting issue via the cache-folder parameter due to insufficient input sanitization and output escaping. This...

CVE-2024-11713: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'pageid' parameter of the wpjobportaldeactivate function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied...

CVE-2024-11710: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'fieldfor', 'visibleParent' and 'id' parameters in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter an...

CVE-2024-9698: Unrestricted Upload of File with Dangerous Type

The Crafthemes Demo Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'processuploadedfiles' function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Administrator-level access and...

CVE-2024-12628: Improper Neutralization of Input During Web Page Generation

The bodi0s Easy cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cache-folder' parameter in all versions up to, and including, 0.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

CVE-2024-11714: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'ff' parameter of the getFieldsForVisibleCombobox function in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied...