WordPress Heureka Plugin <= 1.1.0 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by Nabil Irawan in WordPress Plugin Heureka versions = 1.1.0...

WordPress Product Time Countdown for WooCommerce plugin <= 1.6.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nabil Irawan in WordPress Plugin Product Time Countdown for WooCommerce versions = 1.6.5...

WordPress Append extensions on Pages Plugin <= 1.1.2 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Append extensions on Pages versions = 1.1.2...

WordPress WP Subtitle Plugin <= 3.4.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by theviper17 in WordPress Plugin WP Subtitle versions = 3.4.1...

WordPress Upcoming Events Lists Plugin <= 1.4.0 - Insecure Direct Object References (IDOR) Vulnerability

Insecure Direct Object References IDOR Vulnerability discovered by Nabil Irawan in WordPress Plugin Upcoming Events Lists versions = 1.4.0...

WordPress WP Gravity Forms Keap/Infusionsoft plugin <= 1.2.6 - Open Redirection vulnerability

Open Redirection vulnerability discovered by Bonds in WordPress Plugin WP Gravity Forms Keap/Infusionsoft versions = 1.2.6...

WordPress Ultimate Store Kit Elementor Addons plugin <= 2.8.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Abu Hurayra in WordPress Plugin Ultimate Store Kit Elementor Addons versions = 2.8.6...

WordPress VoucherPress Plugin <= 1.5.7 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Le Cong Danh vodanh in WordPress Plugin VoucherPress versions = 1.5.7...

WordPress WP Category Dropdown Plugin <= 1.9 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by zaim in WordPress Plugin WP Category Dropdown versions = 1.9...

WordPress Bg Church Memos Plugin <= 1.1 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Gilang Asra Bilhadi in WordPress Plugin Bg Church Memos versions = 1.1...

WordPress DOAJ Export Plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Jieun Kim in WordPress Plugin DOAJ Export versions = 1.0.4...

WordPress Grid plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Grid versions = 2.3.1...

WordPress Proof Factor – Social Proof Notifications Plugin <= 1.0.5 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Vinit Lakra in WordPress Plugin Proof Factor Social Proof Notifications versions = 1.0.5...

WordPress Kama Click Counter plugin <= 4.0.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by muhammad yudha in WordPress Plugin Kama Click Counter versions = 4.0.4...

WordPress Casengo Live Chat Support Plugin <= 2.1.4 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Casengo Live Chat Support versions = 2.1.4...

WordPress Genesis Club Lite Plugin <= 1.17 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Genesis Club Lite versions = 1.17...

CVE-2025-58974

CVE-2025-58974 (WPComplete) is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin WPComplete. The CVE entry covers the WPComplete plugin and notes impact on versions up to 2.9.5.2, where improper neutralization of input during web page generation leads to stored XSS. Connec...

CVE-2025-59572 WordPress WorkScout-Core Plugin < 1.7.06 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in purethemes WorkScout-Core workscout-core allows Cross Site Request Forgery.This issue affects WorkScout-Core: from n/a through 1.7.06...

CVE-2025-59573

CVE-2025-59573: Cozy Blocks (Cozy Themes) for WordPress vulnerable to unauthenticated arbitrary shortcode execution via improper neutralization of script-related HTML; affected versions up to 2.1.29; patch available in 2.1.29; CVSS 3.1 Base 5.3 (Medium).

CVE-2025-59574 WordPress WP Travel Engine Plugin <= 1.4.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Travel Engine WP Travel Engine allows Stored XSS. This issue affects WP Travel Engine: from n/a through 1.4.2...