WordPress SureForms plugin < 1.7.2 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin SureForms versions 1.7.2...

WordPress Alike - WordPress Custom Post Comparison <= 3.0.1 - Cross Site Scripting (XSS) Vulnerability

WordPress Alike - WordPress Custom Post Comparison = 3.0.1 - Cross Site Scripting XSS Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Plugin Alike - WordPress Custom Post Comparison versions = 3.0.1...

WordPress Ghost Kit <= 3.4.1 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by LVT-tholv2k in WordPress Plugin Ghost Kit versions = 3.4.1...

WordPress Aiomatic plugin <= 2.5.0 - Authenticated (Subscriber+) Arbitrary File Upload vulnerability

Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by khanhhnahk1 in WordPress Plugin Aiomatic versions = 2.5.0...

WordPress Bluff Post plugin <= 1.1.1 - Cross Site Request Forgery (CSRF) Vulnerability

Cross Site Request Forgery CSRF Vulnerability discovered by Nguyen Xuan Chien in WordPress Plugin Bluff Post versions = 1.1.1...

WordPress WidgetKit Pro plugin <= 1.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Nguyễn Trung Kiên anhchangmutrang in WordPress Plugin WidgetKit Pro versions = 1.13.1...

WordPress Aora Theme <= 1.3.9 is vulnerable to Local File Inclusion

Software Aora Type Theme Vulnerable versions = 1.3.9 Fixed in 1.3.10 OWASP Top 10 A4: Insecure Design Classification Local File Inclusion CVE CVE-2025-49260 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID c279fefa752d Credits Phat RiO - BlueRock Required privilege...

WordPress WP Social Widget plugin <= 2.3 - Cross Site Scripting (XSS) Vulnerability

Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin WP Social Widget versions = 2.3...

WordPress Smash Balloon Instagram Feed plugin <= 6.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-plugin` Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via data-plugin Attribute vulnerability discovered by Asaf Mozes in WordPress Plugin Instagram Feed versions = 6.9.0...

WordPress WP SMTP plugin <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting via Email vulnerability

Unauthenticated Stored Cross-Site Scripting via Email vulnerability discovered by zer0gh0st in WordPress Plugin WP SMTP versions = 2.1.5...

WordPress ReDi Restaurant Reservation plugin <= 24.1209 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Ryan Novotny in WordPress Plugin ReDi Restaurant Reservation versions = 24.1209...

WordPress Pet World Theme <= 2.8 is vulnerable to PHP Object Injection

Software Pet World Type Theme Vulnerable versions = 2.8 Fixed in N/A OWASP Top 10 A3: Injection Classification PHP Object Injection CVE CVE-2025-32284 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID e46bfa7f1a9a Credits Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity...

WordPress Url Rewrite Analyzer plugin <= 1.3.3 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Url Rewrite Analyzer versions = 1.3.3...

WordPress Shortlinks by Pretty Links plugin <= 3.6.15 - Broken Access Control Vulnerability

Broken Access Control Vulnerability discovered by domiee13 in WordPress Plugin Shortlinks by Pretty Links versions = 3.6.15...

CVE-2025-32999

Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges. If this vulnerability is exploited, an arbitrary...

WordPress JavaScript Logic plugin <= 0.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Daniel Ruf in WordPress Plugin JavaScript Logic versions = 0.1...

WordPress Sailthru Triggermail plugin < 1.1 - Subscriber+ Stored XSS vulnerability

Subscriber+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Sailthru Triggermail versions 1.1...

WordPress Mortgage Calculator Estatik plugin <= 2.0.12 - Local File Inclusion Vulnerability

Local File Inclusion Vulnerability discovered by muhammad yudha in WordPress Plugin Mortgage Calculator Estatik versions = 2.0.12...

WordPress Arconix Shortcodes plugin <= 2.1.16 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Peter Thaleikis in WordPress Plugin Arconix Shortcodes versions = 2.1.16...

WordPress Relevanssi Premium plugin <= 2.27.4 - Unauthenticated SQL Injection

Unauthenticated SQL Injection vulnerability discovered by Jack Taylor in WordPress Plugin Relevanssi Premium versions = 2.27.4...