PT-2025-7392

Name of the Vulnerable Software and Affected Versions User Private Files – File Upload & Download Manager with Secure File Sharing plugin for WordPress versions up to, and including, 2.1.3 Description The issue is related to Stored Cross-Site Scripting via the new-fldr-name parameter due to...

CVE-2024-13689 Uncode Core <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary Shortcode Execution in uncode_get_medias

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

CVE-2024-13667

The Uncode theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘mle-description’ parameter in all versions up to, and including, 2.9.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level acces...

CVE-2024-13691

CVE-2024-13691 affects Uncode (WordPress)

CVE-2024-13667

CVE-2024-13667 (Uncode Theme, WordPress) : Wordfence and NVD describe a stored XSS in the Uncode theme via the mle-description parameter, affecting Uncode versions up to 2.9.1.6. An authenticated user with Subscriber-level access or higher can inject scripts into pages, which execute when other u...

CVE-2024-13369

The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘reviewid’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

CVE-2024-13687

The Team Builder – Meet the Team plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the saveteambuilderoptions function in all versions up to, and including, 1.3. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2025-6592

Name of the Vulnerable Software and Affected Versions Uncode theme for WordPress versions up to, and including, 2.9.1.6 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows authenticated attackers wit...

PT-2025-6597

Name of the Vulnerable Software and Affected Versions Uncode Core plugin for WordPress versions up to, and including, 2.9.1.6 Description The issue allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes due to the software not properly validating a...

CVE-2024-13689: Improper Control of Generation of Code

The Uncode Core plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.9.1.6. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

PT-2025-6543

Name of the Vulnerable Software and Affected Versions The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress versions up to, and including, 5.3.6 Description The issue is related to time-based SQL Injection via the review id parameter due to insufficient escaping on the user-supplied...

PT-2025-6593

Name of the Vulnerable Software and Affected Versions GetBookingsWP – Appointments Booking Calendar Plugin For WordPress versions up to 1.1.27 Description The issue arises from the plugin's failure to properly validate a user's identity before updating their details, such as email addresses. This...

CVE-2024-13439

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response function in all versions up to, and including, 4.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

CVE-2025-0821

Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2024-13439: Missing Authorization

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the response function in all versions up to, and including, 4.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to...

PT-2025-6554

Name of the Vulnerable Software and Affected Versions The WP Project Manager versions up to, and including, 2.6.17 Description The issue is related to time-based SQL Injection via the orderby parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation ...

CVE-2025-0822: Relative Path Traversal

Bit Assist plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.5.2 via the fileID Parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contai...

CVE-2024-13814

The The Global Gallery - WordPress Responsive Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 9.1.5. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

CVE-2024-13374

The WP Table Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on thewptmgetFolders AJAX action in all versions up to, and including, 4.1.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read...

CVE-2024-12164

The WPSyncSheets Lite For WPForms – WPForms Google Spreadsheet Addon plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsslwpresetsettings function in all versions up to, and including, 1.6. This makes it possible for authenticated...