23739 matches found
EUVD-2026-3813
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in favethemes Houzez Theme - Functionality houzez-theme-functionality allows Stored XSS.This issue affects Houzez Theme - Functionality: from n/a through = 4.2.6...
CVE-2026-22482
Server-Side Request Forgery SSRF vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through = 2.3.12...
EUVD-2026-3838
Authorization Bypass Through User-Controlled Key vulnerability in Mikado-Themes Curly curly allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Curly: from n/a through = 3.3...
CVE-2025-69055 WordPress BM Content Builder plugin < 3.16.3.3 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in SeaTheme BM Content Builder bm-builder allows Path Traversal.This issue affects BM Content Builder: from n/a through 3.16.3.3...
CVE-2025-69048
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LambertGroup Universal Video Player universal-video-player allows Reflected XSS.This issue affects Universal Video Player: from n/a through = 3.8.4...
CVE-2025-69047
CVE-2025-69047 affects magentech MaxShop sw_maxshop (WordPress/MaxShop template) through 3.6.20. It is a PHP Local File Inclusion caused by improper control of the filename used in include/require statements, enabling inclusion of local files. Remediation per the sources is to upgrade to a versio...
EUVD-2026-3947
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Dekoro dekoro allows PHP Local File Inclusion.This issue affects Dekoro: from n/a through = 1.0.7...
EUVD-2026-3943
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Bailly bailly allows PHP Local File Inclusion.This issue affects Bailly: from n/a through = 1.3.4...
CVE-2025-69002
CVE-2025-69002 describes a Deserialization of Untrusted Data vulnerability in designthemes OneLife/OneLife theme for WordPress, enabling Object Injection. Affected software: OneLife (WordPress Theme) up to version 3.9. Root cause: deserialization of untrusted data leading to object injection. Imp...
CVE-2025-68871 WordPress Dooodl plugin <= 2.3.0 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in noCreativity Dooodl dooodl allows Reflected XSS.This issue affects Dooodl: from n/a through = 2.3.0...
CVE-2025-68871
CVE-2025-68871 is a Reflected XSS vulnerability in the WordPress Dooodl plugin (<= 2.3.0). The issue arises from improper input neutralization during web page generation, enabling injected scripts to run in victims’ browsers. Affected software: Dooodl plugin for WordPress, versions up to and i...
CVE-2025-68857 WordPress Paid Downloads plugin <= 3.15 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through = 3.15...
CVE-2025-68857
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in ichurakov Paid Downloads paid-downloads allows Blind SQL Injection.This issue affects Paid Downloads: from n/a through = 3.15...
CVE-2025-68857
CVE-2025-68857 concerns WordPress’s Paid Downloads plugin (versions <= 3.15). The flaw is an unauthenticated blind SQL Injection caused by improper neutralization of elements in SQL queries, enabling manipulation/exfiltration of database data. The CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/...
CVE-2025-68538 WordPress Craft | Coffee Shop Cafe Restaurant WordPress theme <= 2.3.6 - Reflected Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGoods Craft craftcoffee allows DOM-Based XSS.This issue affects Craft: from n/a through = 2.3.6...
CVE-2025-68835
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in matiskiba Ravpage ravpage allows Reflected XSS.This issue affects Ravpage: from n/a through = 2.33...
EUVD-2026-4003
Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through = 3.5.17...
CVE-2025-68010
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in netgsm Netgsm netgsm allows Reflected XSS.This issue affects Netgsm: from n/a through = 2.9.63...
CVE-2025-67958
CVE-2025-67958 affects the TaxCloud for WooCommerce plugin (simple-sales-tax) for WordPress; a broken/misconfigured access control enables missing authorization via vulnerable versions up to and including 8.3.8. Impact details in sources indicate broken access control rather than remote code exec...
CVE-2025-67947
CVE-2025-67947 affects AdForest Elementor (adforest-elementor) for WordPress, with an unauthenticated Reflected XSS due to improper input handling during web page generation. Affected version range: