CVE-2025-3055

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteavatarajax function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-3054 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

CVE-2025-3054 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Upload

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

CVE-2025-3055 WP User Frontend Pro <= 4.1.3 - Authenticated (Subscriber+) Arbitrary File Deletion

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteavatarajax function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-3054

The WP User Frontend Pro plugin for WordPress (versions up to and including 4.1.3 ) is vulnerable to arbitrary file uploads due to a lack of file type validation in the upload_files() function. This flaw allows authenticated attackers with Subscriber-level access or higher to upload arbitrary fil...

WordPress Booking Ultra Pro plugin <= 1.1.20 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by Nabil Irawan in WordPress Plugin Booking Ultra Pro versions = 1.1.20...

WordPress ShortLinks Pro plugin <= 1.0.7 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Nguyen Kim Sang in WordPress Plugin ShortLinks Pro versions = 1.0.7...

WordPress FraudLabs Pro for WooCommerce plugin <= 2.22.11 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by ch4r0n in WordPress Plugin FraudLabs Pro for WooCommerce versions = 2.22.11...

PT-2025-23945 · Unknown · Bdthemes Element Pack Pro

Name of the Vulnerable Software and Affected Versions: BdThemes Element Pack Pro versions prior to 8.0.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions prior t...

WordPress plugin Element Pack Pro has a cross-site request forgeing vulnerability.

WordPress Element Pack Pro plugin is a WordPress editor plugin extension plugin that is mainly used to enhance and extend the functionality and design capabilities of WordPress websites. The WordPress Element Pack Pro plugin suffers from a cross-site request forgery vulnerability that stems from...

PT-2025-23895 · WordPress · Wp User Frontend Pro

Name of the Vulnerable Software and Affected Versions: WP User Frontend Pro plugin for WordPress versions up to, and including, 4.1.3 Description: The issue is related to insufficient file path validation in the delete avatar ajax function, allowing authenticated attackers with Subscriber-level...

WordPress plugin WP User Frontend Pro has code-related vulnerabilities

WordPress WP User Frontend Pro plugin is a WordPress front-end user center plugin that provides powerful front-end administration features. WordPress WP User Frontend Pro plugin has a code issue vulnerability, the vulnerability stems from the lack of file type validation in the uploadfiles...

PT-2025-23944 · Unknown · Bdthemes Element Pack Pro

Name of the Vulnerable Software and Affected Versions: BdThemes Element Pack Pro versions prior to 8.0.0 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 8.0.0, upda...

WordPress plugin Element Pack Pro has security vulnerabilities

WordPress Element Pack Pro plugin is a WordPress editor plugin extension plugin that is mainly used to enhance and extend the functionality and design capabilities of WordPress websites. WordPress Element Pack Pro plugin suffers from an Improper Access Control vulnerability that stems from improp...

CVE-2025-46258: Missing Authorization

Missing Authorization vulnerability in BdThemes Element Pack Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Element Pack Pro: from n/a before 8.0.0...

CVE-2025-46257: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in BdThemes Element Pack Pro allows Cross Site Request Forgery.This issue affects Element Pack Pro: from n/a before 8.0.0...

CVE-2025-3055: Improper Limitation of a Pathname to a Restricted Directory

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteavatarajax function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above,...

CVE-2025-3054: Unrestricted Upload of File with Dangerous Type

The WP User Frontend Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the uploadfiles function in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload...

WordPress plugin WP User Frontend Pro has a path traversal vulnerability

WordPress WP User Frontend Pro plugin is a WordPress front-end user center plugin that provides powerful front-end administration features. WordPress WP User Frontend Pro plugin has a path traversal vulnerability that stems from insufficient file path validation in the deleteavatarajax function. ...

CVE-2025-27444

A reflected XSS vulnerability in RSform!Pro component 3.0.0 - 3.3.13 for Joomla was discovered. The issue arises from the improper handling of the filterdateFrom GET parameter, which is reflected unescaped in the administrative backend interface. This allows an authenticated attacker with admin o...