PT-2025-6798 · WordPress · Simple Video Management System

Name of the Vulnerable Software and Affected Versions: Simple Video Management System WordPress plugin versions 1.0.0 through 1.0.4 Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks. This is possible because the plugin does not...

WordPress Plugin: Embed Google Maps – Cross-site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin Bootstrap collapse cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress WP Extra Fields plugin <= 1.0.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin WP Extra Fields versions = 1.0.1...

CVE-2024-10322 Brizy – Page Builder <= 2.6.8 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API SVG File uploads in all versions up to, and including, 2.6.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

CVE-2024-10322

Brizy – Page Builder for WordPress is affected by CVE-2024-10322: a Stored Cross-Site Scripting vulnerability via REST API SVG file uploads in all versions up to 2.6.8. The root cause is insufficient input sanitization and output escaping, enabling authenticated attackers with Author-level access...

CVE-2024-13477 LTL Freight Quotes – Unishippers Edition <= 2.5.8 - Unauthenticated SQL Injection

The LTL Freight Quotes – Unishippers Edition plugin for WordPress is vulnerable to SQL Injection via the 'editid' parameter in all versions up to, and including, 2.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2024-10960

CVE-2024-10960 affects Brizy – Page Builder for WordPress up to and including version 2.6.4. The issue is an authenticated arbitrary file upload via the storeUploads function, exploitable by attackers with Contributor-level access and above, potentially leading to remote code execution on the aff...

CVE-2024-13437

The Book a Room plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9. This is due to missing or incorrect nonce validation on the 'bookaroomSettings' page. This makes it possible for unauthenticated attackers to update the plugin's settings vi...

CVE-2024-13475

CVE-2024-13475 affects the WordPress plugin Small Package Quotes – UPS Edition . The vulnerability is an unauthenticated SQL Injection via the parameter named edit_id in all versions up to and including 4.5.16 , caused by insufficient escaping of user input and lack of proper query preparation. A...

CVE-2024-13814

The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-12315

CVE-2024-12315 corresponds to the WordPress plugin WP Ultimate Exporter (exports all posts/products/orders/refunds/users). The Wordfence and CVE lists confirm information disclosure in all versions up to 2.9.3 via an unprotected exports directory (/wp-content/uploads/smack_uci_uploads/exports/), ...

CVE-2024-13600

The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.5 via the 'majesticsupportdata' directory. This makes it possible for unauthenticated attackers to extract...

CVE-2024-13714

CVE-2024-13714 affects The All-Images.ai – IA Image Bank and Custom Image creation plugin for WordPress (versions up to 1.0.4). The root cause is missing file type validation in the _get_image_by_url function, allowing authenticated users with Subscriber+ privileges to upload arbitrary files to t...

CVE-2024-13601

CVE-2024-13601 affects Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin for WordPress. Description: Insecure Direct Object Reference via exportusereraserequest in all versions up to 1.0.5, enabling authenticated users with Subscriber+ access to export ticket data for any us...

CVE-2024-13800

The ConvertPlus plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the 'cpdismissnotice' AJAX endpoint in all versions up to, and including, 3.5.30. This makes it possible for authenticated attackers,...

CVE-2024-13665

The CVE CVE-2024-13665 affects the Admire Extra WordPress plugin (versions up to 1.6). It is a Stored XSS via the space shortcode due to insufficient input sanitization/output escaping for authenticated users with Contributor+ privileges. Impact: arbitrary script injection on pages viewed by user...

CVE-2025-0808 Houzez Property Feed <= 2.4.21 - Cross-Site Request Forgery to Property Feed Export Deletion

The Houzez Property Feed plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.21. This is due to missing or incorrect nonce validation on the "deleteexport" action. This makes it possible for unauthenticated attackers to delete property feed...

WordPress plugin Admire Extra has a cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress plugin ShipEngine has a SQL injection vulnerability in its shipping quotes functionality.

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...