CVE-2025-10302

CVE-2025-10302 affects the WordPress plugin Ultimate Viral Quiz (versions ≤ 1.0). The vulnerability is a Cross-Site Request Forgery due to missing/incorrect nonce validation in the save_options() function, allowing unauthenticated attackers to update plugin settings if a site administrator is tri...

CVE-2025-10302 Ultimate Viral Quiz <= 1.0 - Cross-Site Request Forgery to Settings Update

The Ultimate Viral Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on thesaveoptions function. This makes it possible for unauthenticated attackers to update the plugin's settings...

CVE-2025-9630 WP SinoType <= 1.0 - Cross-Site Request Forgery

The WP SinoType plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the sinotypeconfig function. This makes it possible for unauthenticated attackers to modify typography settings via a...

CVE-2025-9630

The CVE concerns WP SinoType (WordPress) plugin vulnerable to Cross-Site Forgery (CSRF) in versions ≤ 1.0 due to missing/incorrect nonce validation in sinotype_config, enabling unauthenticated attackers to modify typography settings if a site admin is tricked. Public details confirm affected soft...

CVE-2025-9892 Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update

The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2025-9892

CVE-2025-9892 describes a Cross-Site Forgery vulnerability in the WordPress plugin Restrict User Registration (versions ≤ 1.0.1) due to missing nonce validation in the update() function. This allows unauthenticated attackers to update plugin settings by mislead­ing an admin into performing an act...

CVE-2025-9892 Restrict User Registration <= 1.0.1 - Cross-Site Request Forgery to Settings Update

The Restrict User Registration plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the update function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2025-10309 PayPal Forms <= 1.0.3 - Cross-Site Request Forgery

The PayPal Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing nonce validation on the form creation and management functions. This makes it possible for unauthenticated attackers to create new PayPal forms and...

CVE-2025-10053

CVE-2025-10053 concerns the WordPress plugin TableGen – Data Table Generator . The vulnerability is a stored XSS in admin settings due to insufficient input sanitization and output escaping, affecting all versions up to 1.3.1. Exploitation requires authenticated access with administrator-level pr...

CVE-2025-9945

CVE-2025-9945 affects the WordPress plugin “Optimize More! – CSS” (versions up to 1.0.3). The issue is a Cross-Site Request Forgery caused by missing/incorrect nonce validation in the reset_plugin function, allowing unauthenticated attackers to trigger a site administrator action to reset plugin ...

CVE-2025-9945 Optimize More! – CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset

The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the resetplugin function. This makes it possible for unauthenticated attackers to reset the plugin's...

CVE-2025-9945 Optimize More! – CSS <= 1.0.3 - Cross-Site Request Forgery to Plugin Settings Reset

The Optimize More! – CSS plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the resetplugin function. This makes it possible for unauthenticated attackers to reset the plugin's...

EUVD-2025-32273

The Mobile Site Redirect plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious w...

CVE-2025-9884

The CVE-2025-9884 entry concerns the WordPress plugin Mobile Site Redirect (versions up to and including 1.2.1). The issue is a Cross-Site Request Forgery (CSRF) that, due to missing or incorrect nonce validation, can allow unauthenticated attackers to induce a site administrator to perform actio...

CVE-2025-9333 Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2025-9333 Smart Docs <= 1.1.1 - Authenticated (Admin+) Stored Cross-Site Scripting

The Smart Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and...

CVE-2025-9333

CVE-2025-9333 affects the WordPress plugin Smart Docs. The vulnerability is a Stored Cross-Site Scripting flaw in admin settings for versions up to and including 1.1.1, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access with administrator-lev...

CVE-2025-10311 Comment Info Detector <= 1.0.5 - Cross-Site Request Forgery to Settings Update

The Comment Info Detector plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.5. This is due to missing nonce validation on the options.php file when handling form submissions. This makes it possible for unauthenticated attackers to modify...

CVE-2025-61597

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting XSS via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will...

CVE-2025-61597 Emlog Pro is vulnerable to stored XSS attack through HTML template injection

Emlog is an open source website building system. In versions 2.5.21 and below, an HTML template injection allows stored cross‑site scripting XSS via the mail template settings. Once a malicious payload is saved, any subsequent visit to the settings page in an authenticated admin context will...