16148 matches found
WordPress Broken Link Notifier plugin code execution vulnerability
WordPress Broken Link Notifier plugin is a plugin for monitoring broken links e.g. 404 errors, timeout links, etc. within a website. A code execution vulnerability exists in the WordPress Broken Link Notifier plugin that stems from the possibility of embedding malicious input when exporting CSV...
WordPress JetSearch plugin <= 3.5.10 - SQL Injection vulnerability
SQL Injection vulnerability discovered by stealthcopter in WordPress Plugin JetSearch versions = 3.5.10...
WordPress Stop User Enumeration plugin < 1.7.3 - Protection Bypass vulnerability
Protection Bypass vulnerability discovered by Stan, Chin Siang Leow in WordPress Plugin Stop User Enumeration versions 1.7.3...
WordPress Transposh WordPress Translation plugin <= 1.0.7 - Unauthenticated Stored Cross-Site Scripting via 'tp_translation' vulnerability
Unauthenticated Stored Cross-Site Scripting via 'tptranslation' vulnerability discovered by Julien Ahrens in WordPress Plugin Transposh WordPress Translation versions = 1.0.7...
WordPress WooCommerce Shop Page Builder <= 2.27.7 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin WooCommerce Shop Page Builder versions = 2.27.7...
WordPress Apollo - Sticky Full Width HTML5 Audio Player <= 3.4 - Cross Site Scripting (XSS) Vulnerability
WordPress Apollo - Sticky Full Width HTML5 Audio Player = 3.4 - Cross Site Scripting XSS Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Apollo - Sticky Full Width HTML5 Audio Player versions = 3.4...
CVE-2025-7341
The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the tempfiledelete function in all versions up to, and including, 2.2.1. This makes it possible for...
CVE-2025-7712
The Madara - Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the wpmangadeletezip function in all versions up to, and including, 2.2.3. This makes it possible for unauthenticated attackers to delete arbitrary files on the server, whic...
CVE-2025-5396
CVE-2025-5396 affects the Bears Backup plugin for WordPress (all versions up to 2.0.0). Root cause: bbackup_ajax_handle() lacks a capability check and passes unsanitized input directly to call_user_func(), enabling unauthenticated remote code execution. Impact includes potential backdoors or crea...
WordPress Image Wall plugin <= 3.1 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Peter Thaleikis in WordPress Plugin Image Wall versions = 3.1...
WordPress LightBox Block plugin <= 1.1.30 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by Prissy in WordPress Plugin LightBox Block versions = 1.1.30...
WordPress SMTP for Amazon SES plugin <= 1.9 - SQL Injection Vulnerability
SQL Injection Vulnerability discovered by Lê Quốc Bảo in WordPress Plugin SMTP for Amazon SES versions = 1.9...
WordPress Wallet System for WooCommerce plugin <= 2.6.7 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Wallet System for WooCommerce versions = 2.6.7...
WordPress Newsletters plugin <= 4.10 - Cross Site Request Forgery (CSRF) Vulnerability
Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Newsletters versions = 4.10...
WordPress CM Pop-Up banners plugin <= 1.8.4 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by Bao BlueRock in WordPress Plugin CM Pop-Up banners versions = 1.8.4...
WordPress Videopack plugin <= 4.10.3 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by 63n0 in WordPress Plugin Videopack versions = 4.10.3...
WordPress JetSmartFilters plugin <= 3.6.8 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by stealthcopter in WordPress Plugin JetSmartFilters versions = 3.6.8...
WordPress Bold Page Builder plugin <= 5.4.1 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by theviper17 in WordPress Plugin Bold Page Builder versions = 5.4.1...
WordPress JetFormBuilder plugin <= 3.5.1.2 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Que Thanh Tuan Blue Rock in WordPress Plugin JetFormBuilder versions = 3.5.1.2...