CVE-2025-28952 WordPress CubePoints plugin <= 3.2.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jonathan Lau CubePoints cubepoints allows Cross Site Request Forgery.This issue affects CubePoints: from n/a through = 3.2.1...

CVE-2025-28994

CVE-2025-28994 affects Viral Loops WP Integration (WordPress plugin) up to version 3.8.1 and is reported as a Missing Authorization vulnerability (bypass of access control). The available connected sources provide the issue and affected versions, but do not include exploit details. Public status ...

CVE-2025-29011 WordPress YouTube Simple Gallery plugin <= 2.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CHR Designer YouTube Simple Gallery youtube-simple-gallery allows Stored XSS.This issue affects YouTube Simple Gallery: from n/a through = 2.2.0...

CVE-2025-30625 WordPress AppBanners plugin <= 1.5.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matt Pramschufer AppBanners appbanners allows Stored XSS.This issue affects AppBanners: from n/a through = 1.5.14...

CVE-2025-30630 WordPress Global Translator plugin <= 2.0.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in pozzad Global Translator global-translator allows Stored XSS.This issue affects Global Translator: from n/a through = 2.0.2...

CVE-2025-30634 WordPress WP Featured Content Slider plugin <= 2.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IWEBIX WP Featured Content Slider wp-featured-content-slider allows Stored XSS.This issue affects WP Featured Content Slider: from n/a through = 2.6...

CVE-2025-30941 WordPress Pinterest Verify Meta Tag plugin <= 1.3 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marvie Pons Pinterest Verify Meta Tag pinterest-verify-meta-tag allows Stored XSS.This issue affects Pinterest Verify Meta Tag: from n/a through = 1.3...

CVE-2025-30952 WordPress Nexa Blocks plugin <= 1.1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpdive Nexa Blocks nexa-blocks allows Stored XSS.This issue affects Nexa Blocks: from n/a through = 1.1.0...

CVE-2025-30976 WordPress Nexa Blocks plugin <= 1.1.1 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in wpdive Nexa Blocks nexa-blocks allows Server Side Request Forgery.This issue affects Nexa Blocks: from n/a through = 1.1.1...

CVE-2025-30978

CVE-2025-30978 : Missing Authorization in the Slack Notifications by dorzki WordPress plugin (versions from n/a to 2.0.7) due to incorrectly configured access control levels. The vulnerability has a CVSS v3.1 base score of 4.3 (Medium) with network attack vector and low privilege/complexity requi...

CVE-2025-30989

CVE-2025-30989 describes an SQL Injection in the WordPress plugin “Libro de Reclamaciones y Quejas” by Renzo Tejada. The flaw stems from improper neutralization of special elements in SQL commands, enabling unauthenticated SQL manipulation. Affected version range is from n/a through 0.9. The publ...

CVE-2025-49306

CVE-2025-49306 is a stored XSS in WordPress WP Social Widget due to improper input neutralization during web page generation. Affected: WP Social Widget up to version 2.3 (including). The connected sources (Wordfence WordPress vulnerability report) confirm stored XSS and affected version, but do ...

CVE-2025-49299 WordPress WebHotelier plugin <= 1.9.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPlugged.com WebHotelier webhotelier allows Stored XSS.This issue affects WebHotelier: from n/a through = 1.9.2...

CVE-2025-49291 WordPress Calculated Fields Form <= 5.3.58 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in codepeople Calculated Fields Form allows Cross Site Request Forgery. This issue affects Calculated Fields Form: from n/a through 5.3.58...

CVE-2025-49289 WordPress PDF for WPForms <= 5.5.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in add-ons.org PDF for WPForms allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for WPForms: from n/a through 5.5.0...

CVE-2025-49288 WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability

Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through = 1.3.5...

CVE-2025-49268

CVE-2025-49268 is a missing-authorization (broken access control) vulnerability in Verge3D by Soft8Soft. Affected software: Verge3D Publishing and E‑Commerce, versions up to and including 4.9.4 (historical range listed as from n/a through 4.9.4). Public references indicate unauthorized access con...

CVE-2025-49262 WordPress Sina Extension for Elementor <= 3.6.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in shaonsina Sina Extension for Elementor allows Stored XSS. This issue affects Sina Extension for Elementor: from n/a through 3.6.1...

CVE-2025-49250 WordPress Team Showcase plugin < 25.05.13 - Arbitrary Shortcode Execution vulnerability

Improper Control of Generation of Code 'Code Injection' vulnerability in cmoreira Team Showcase team-showcase-cm allows Code Injection.This issue affects Team Showcase: from n/a through 25.05.13...

CVE-2025-49238

CVE-2025-49238 is a CSRF vulnerability in the Everest Backup WordPress plugin by Everest Themes affecting versions up to 2.3.3. The Wordfence vulnerability entry notes this was a Cross-Site Request Forgery issue with a CVSS v3.1 base score of 4.3 (Medium) and indicates patching has been applied i...