16337 matches found
CVE-2025-5570
The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the mwaichatbot shortcode 'id' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-6244
The Essential Addons for Elementor – Popular Elementor Templates and Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the via Calendar And Business Reviews Widgets attributes in all versions up to, and including, 6.1.19 due to insufficient input sanitization and outpu...
WordPress WP Front-end login and register cross-site scripting vulnerability
WP Front-end login and register is a WordPress front-end account management plugin, mainly used in the front-end of the site to achieve user registration, login and password change functions, without having to jump to the WordPress background. WordPress WP Front-end login and register has a...
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
IrfanView CADImage Plugin CGM File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
PT-2025-28707 · Irfanview · Irfanview
Name of the Vulnerable Software and Affected Versions: IrfanView CADImage Plugin affected versions not specified Description: The IrfanView CADImage Plugin contains a flaw in the parsing of DWG files due to insufficient validation of user-supplied data. This can lead to a memory corruption...
IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView CADImage Plugin. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
WordPress Guest Support plugin <= 1.2.2 - Missing Authorization to Unauthenticated Ticket Deletion vulnerability
Missing Authorization to Unauthenticated Ticket Deletion vulnerability discovered by Amin Beheshti in WordPress Plugin Guest Support versions = 1.2.2...
WordPress WP Human Resource Management plugin 2.0.0-2.2.17 - Missing Authorization to Authenticated (Employee+) Privilege Escalation vulnerability
Missing Authorization to Authenticated Employee+ Privilege Escalation vulnerability discovered by kr0d in WordPress Plugin WP Human Resource Management versions 2.0.0-2.2.17...
WordPress Ultimate Push Notifications plugin <= 1.2.0 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by astra.r3verii in WordPress Plugin Ultimate Push Notifications versions = 1.2.0...
WordPress Profiler - What Slowing Down Your WP <= 1.0.0 - Broken Access Control Vulnerability
WordPress Profiler - What Slowing Down Your WP = 1.0.0 - Broken Access Control Vulnerability discovered by ch4r0n Patchstack Alliance in WordPress Plugin Profiler - What Slowing Down Your WP versions = 1.0.0...
WordPress Pay with Contact Form 7 plugin <= 1.0.4 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Pay with Contact Form 7 versions = 1.0.4...
WordPress SMu Manual DoFollow plugin <= 1.8.1 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Nguyen Xuan Chien Patchstack Alliance in WordPress Plugin SMu Manual DoFollow versions = 1.8.1...
WordPress Media Folder plugin <= 1.0.0 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Media Folder versions = 1.0.0...
WordPress Site Chat on Telegram plugin <= 1.0.4 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Drew / mcdruid in WordPress Plugin Site Chat on Telegram versions = 1.0.4...
CVE-2024-11937
The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's linkURL in the Mobile Menu element in all versions up to, and including, 4.10.69 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...
CVE-2025-5953
The WP Human Resource Management plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization in the ajaxinsertemployee and updateempoyee functions in versions 2.0.0 through 2.2.17. The AJAX handler reads the client-supplied $POST'role' and, after basic cleaning via...
CVE-2025-5933
The RD Contacto plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorrect nonce validation on the rdWappUpdateData function. This makes it possible for unauthenticated attackers to update plugin settings via a...