CVE-2025-63008 WordPress WP ERP plugin <= 1.16.7 - Broken Access Control vulnerability

Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP ERP: from n/a through = 1.16.7...

CVE-2025-62996 WordPress Custom Layouts – Post + Product grids made easy plugin <= 1.4.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in Code Amp Custom Layouts – Post + Product grids made easy custom-layouts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Layouts – Post + Product grids made easy: from n/a through = 1.4.12...

CVE-2025-62994

CVE-2025-62994 relates to the WordPress plugin WP AI CoPilot (ai-co-pilot-for-wp) with versions up to and including 1.2.7. The issue is described as an insertion of sensitive information into sent data, enabling retrieval of embedded sensitive data (information disclosure). The CVSS 3.1 vector in...

CVE-2025-62995 WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.12 - Broken Access Control vulnerability

Missing Authorization vulnerability in multiparcels MultiParcels Shipping For WooCommerce multiparcels-shipping-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiParcels Shipping For WooCommerce: from n/a through = 1.30.12...

CVE-2025-62872 WordPress Social Photo Fetcher plugin <= 3.0.4 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in JK Social Photo Fetcher facebook-photo-fetcher allows Cross Site Request Forgery.This issue affects Social Photo Fetcher: from n/a through = 3.0.4...

CVE-2025-62736 WordPress Image Cleanup plugin <= 1.9.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in opicron Image Cleanup image-cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Image Cleanup: from n/a through = 1.9.2...

CVE-2025-62734 WordPress Media Library Downloader plugin <= 1.4.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in M.Code Media Library Downloader media-library-downloader allows Cross Site Request Forgery.This issue affects Media Library Downloader: from n/a through = 1.4.0...

CVE-2025-62734

CVE-2025-62734 : CSRF in WordPress plugin Media Library Downloader (versions &lt;= 1.4.0) allows cross-site request forgery. Affected software is the Media Library Downloader plugin for WordPress; CVSS 3.1 base score 4.3 (Medium) with network attack vector, no confidentiality/availability impact,...

CVE-2025-62151 WordPress Virtuaria PagBank / PagSeguro para Woocommerce plugin <= 3.6.3 - Broken Access Control vulnerability

Missing Authorization vulnerability in Virtuaria Virtuaria PagBank / PagSeguro para Woocommerce virtuaria-pagseguro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Virtuaria PagBank / PagSeguro para Woocommerce: from n/a through = 3.6.3...

CVE-2025-62100

The CVE-2025-62100 entry describes a Missing Authorization vulnerability in the WordPress ThemeRain Core plugin (themerain-core) affecting versions up to 1.1.9, caused by an incorrectly configured access control security level. The issue is exploitable without authentication over network, with lo...

CVE-2025-62090 WordPress Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons plugin <= 3.0.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jegstudio Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons gutenverse-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gutenverse News – Advanced News Magazine Blog Gutenberg Blocks Addons:...

CVE-2025-62093

The CVE-2025-62093 entry concerns the WordPress plugin Image&Video FullScreen Background (lbg_fullscreen_fullwidth_slider) with a SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. Affected versions are 1.6.7 and earlier; the issue is present in the pl...

CVE-2025-59132

CVE-2025-59132 is a CSRF vulnerability in the WordPress plugin Duplicate Content Cure (versions

CVE-2025-49348

CVE-2025-49348 refers to a Missing Authorization / Broken Access Control issue in the WordPress plugin Hype pico (Hype) , affecting versions from n/a up to and including 1.0.5. Public sources in connected documents confirm this CVE ID, the affected software, and the underlying problem of unauthor...

CVE-2025-67598 WordPress SupportCandy plugin <= 3.4.1 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: from n/a through = 3.4.1...

CVE-2025-67597

CVE-2025-67597 concerns the WordPress Fluent Booking plugin (fluent-booking) with versions up to 1.9.11. The issue is a Missing Authorization vulnerability caused by insufficient access-control checks, enabling unauthorized access to Fluent Booking features. The CVSS v3.1 base score is 4.3 (Mediu...

EUVD-2025-202060

Cross-Site Request Forgery CSRF vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through = 1.2.48...

CVE-2025-67588 WordPress Elementor Website Builder plugin <= 3.33.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Website Builder: from n/a through = 3.33.0...

CVE-2025-67584 WordPress GoDAM plugin <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: from n/a through = 1.4.6...

CVE-2025-67581 WordPress TrueBooker plugin <= 1.1.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TrueBooker: from n/a through = 1.1.0...