3DPrint Lite < 2.1.3.6 - Cross-Site Request Forgery

Description The 3DPrint Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.3.5. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action...

CVE-2025-30852

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emotionalonlinestorytelling Oracle Cards Lite oracle-cards allows Reflected XSS.This issue affects Oracle Cards Lite: from n/a through = 1.2.1...

CVE-2025-30852 WordPress Oracle Cards Lite plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emotionalonlinestorytelling Oracle Cards Lite oracle-cards allows Reflected XSS.This issue affects Oracle Cards Lite: from n/a through = 1.2.1...

CVE-2025-30852 WordPress Oracle Cards Lite plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in emotionalonlinestorytelling Oracle Cards Lite oracle-cards allows Reflected XSS.This issue affects Oracle Cards Lite: from n/a through = 1.2.1...

CVE-2025-30852

CVE-2025-30852 : Oracle Cards Lite for WordPress is affected by a reflected XSS vulnerability in the plugin’s web-page generation input handling, with affected versions ranging up to 1.2.1 (no details on earlier versions provided). Exploitation would require a user to click a crafted URL, enablin...

WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Gab in WordPress Plugin mFolio Lite versions = 1.2.3...

CVE-2025-31847

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themelooks mFolio Lite mfolio-lite allows DOM-Based XSS.This issue affects mFolio Lite: from n/a through = 1.2.3...

CVE-2025-31777

Missing Authorization vulnerability in BeastThemes Clockinator Lite clockify-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clockinator Lite: from n/a through = 1.0.9...

CVE-2025-31767

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through = 1.14...

CVE-2025-31847

CVE-2025-31847 affects mFolio Lite (WordPress)

CVE-2025-31847 WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themelooks mFolio Lite mfolio-lite allows DOM-Based XSS.This issue affects mFolio Lite: from n/a through = 1.2.3...

CVE-2025-31847 WordPress mFolio Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themelooks mFolio Lite mfolio-lite allows DOM-Based XSS.This issue affects mFolio Lite: from n/a through = 1.2.3...

CVE-2025-31777

CVE-2025-31777 concerns Clockinator Lite (BeastThemes) with Missing Authorization affecting Clockinator Lite versions up to 1.0.7. The Wordfence vulnerability entry in the connected docs confirms the affected software and the Missing Authorization issue, but detailed root-cause, impacted configur...

CVE-2025-31777 WordPress Clockinator Lite plugin <= 1.0.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in BeastThemes Clockinator Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Clockinator Lite: from n/a through 1.0.7...

CVE-2025-31777 WordPress Clockinator Lite plugin <= 1.0.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in BeastThemes Clockinator Lite clockify-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Clockinator Lite: from n/a through = 1.0.9...

WordPress Oracle Cards Lite plugin <= 1.2.1 - Reflected Cross Site Scripting (XSS) Vulnerability

Reflected Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Oracle Cards Lite versions = 1.2.1...

CVE-2025-30782

CVE-2025-30782 corresponds to a WordPress vulnerability in the Subscribe to Download Lite plugin (

CVE-2025-30782 WordPress Subscribe to Download Lite plugin <= 1.2.9 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Download Lite subscribe-to-download-lite allows PHP Local File Inclusion.This issue affects Subscribe to Download Lite: from n/a through = 1.2.9...

WordPress plugin Clockinator Lite 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-14225 · Themelooks · Themelooks Mfolio Lite

Name of the Vulnerable Software and Affected Versions: themelooks mFolio Lite versions 1.2.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This means that an attacker...