CVE-2025-8889

The Compress & Upload WordPress plugin (versions prior to 1.0.5 ) is vulnerable to an arbitrary file upload flaw. The plugin fails to properly validate file extensions and MIME types during image uploads via its media interface. An authenticated user with Author privileges or higher can bypass cl...

CVE-2025-8889 Compress Then Upload < 1.0.5 - Admin+ Arbitrary File Upload

The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

PT-2025-36576

Name of the Vulnerable Software and Affected Versions: Compress & Upload WordPress plugin versions prior to 1.0.5 Description: The Compress & Upload WordPress plugin does not properly validate uploaded files, allowing high privilege users, such as administrators, to upload arbitrary files to the...

CVE-2025-8889: Undefined Security Weakness

The Compress & Upload WordPress plugin before 1.0.5 does not properly validate uploaded files, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to for example in multisite setup...

CVE-2023-3666

The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3666 Sticky Side Buttons < 2.0.0 - Admin+ Stored XSS

The Sticky Side Buttons WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3666

The Sticky Side Buttons WordPress plugin versions prior to 2.0.0 is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is a failure to sanitise and escape certain plugin settings, which allows high-privilege users, such as administrators, to execute malicious scripts. This v...

CVE-2025-5083

The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-5083

The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2025-5083

The CVE-2025-5083 issue affects the WordPress Amministrazione Trasparente plugin, vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to 9.0 due to insufficient input sanitization and output escaping. The vulnerability requires authenticated attackers with administrato...

CVE-2025-5083 Amministrazione Trasparente <= 9.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via print_r Function

The Amministrazione Trasparente plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 9.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

PT-2025-35389

Name of the Vulnerable Software and Affected Versions: Amministrazione Trasparente plugin for WordPress versions prior to 9.1 Description: The Amministrazione Trasparente plugin for WordPress is susceptible to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization a...

CVE-2025-8490

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

WordPress MultiSite Clone Duplicator plugin <= 1.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MultiSite Clone Duplicator versions = 1.5.3...

PT-2025-43246

Name of the Vulnerable Software and Affected Versions MultiSite Clone Duplicator versions prior to 1.5.4 Description Reflected Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into...

CVE-2025-8490

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

Linux Distros Unpatched Vulnerability : CVE-2020-28033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress before 5.5.2 mishandles embeds from disabled sites on a multisite network, as demonstrated by allowing a spam embed. CVE-2020-28033 Note that Nessus...

CVE-2025-8490 All-in-One WP Migration and Backup <= 7.97 - Authenticated (Administrator+) Stored Cross-Site Scripting via Import

The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

CVE-2025-8490

CVE-2025-8490 refers to the All-in-One WP Migration and Backup plugin for WordPress, with a stored cross-site scripting (XSS) flaw in the Import path affecting versions up to 7.97. The issue requires authenticated access at administrator level and affects multi-site installations or sites where u...

Linux Distros Unpatched Vulnerability : CVE-2017-5493

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier fo...