CVE-2025-62906 WordPress Referral Link Tracker plugin <= 1.1.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in epiphanyit321 Referral Link Tracker referral-link-tracker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Referral Link Tracker: from n/a through = 1.1.4...

CVE-2025-62904

The CVE concerns the WordPress WP Geo plugin (wp-geo) versions up to and including 3.5.1, with a Stored XSS vulnerability arising from improper input neutralization during Web Page Generation. The issue affects WP Geo in the range from n/a through 3.5.1. The Red Hat and ENISA/enrichment sources c...

CVE-2025-62898 WordPress Links shortcode plugin <= 1.8.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Maarten Links shortcode links-shortcode allows Stored XSS.This issue affects Links shortcode: from n/a through = 1.8.3...

CVE-2025-62897

CVE-2025-62897 affects the WordPress plugin WP Recipe Maker (wp-recipe-maker), with versions up to and including 10.1.1 reported as vulnerable. The underlying issue is “Improper Neutralization of Script-Related HTML Tags” (Basic XSS) that enables Code Injection through content handling in the plu...

CVE-2025-62891 WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.8.5 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus Slidebars off-canvas-sidebars allows Cross Site Request Forgery.This issue affects Off-Canvas Sidebars & Menus Slidebars: from n/a through = 0.5.8.5...

CVE-2025-62890

CVE-2025-62890 is a CSRF vulnerability in the WordPress plugin Premmerce Brands for WooCommerce (versions n/a through 1.2.13). The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields a base score of 4.3 (Medium). The Red Hat and NVD entries corroborate that the issue concerns Cross-Site ...

CVE-2025-62889 WordPress King Addons for Elementor plugin <= 51.1.61 - Broken Access Control vulnerability

Missing Authorization vulnerability in KingAddons.com King Addons for Elementor king-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects King Addons for Elementor: from n/a through = 51.1.61...

CVE-2025-62882

CVE-2025-62882 affects the WordPress plugin Seriously Simple Podcasting (≤ 3.13.0). The root cause is an incorrectly configured access control mechanism that allows missing authorization, enabling a broken access control vulnerability. Reported across multiple sources (Red Hat, EU ENISA EUVD, CVE...

PT-2025-43791

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpopal Opal Service opal-service allows Stored XSS.This issue affects Opal Service: from n/a through = 1.9.1...

PT-2025-43761

Missing Authorization vulnerability in WP Lab WP-Lister Lite for eBay wp-lister-for-ebay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Lister Lite for eBay: from n/a through = 3.8.3...

WordPress plugin Coupon Affiliates has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-43793

Missing Authorization vulnerability in adivaha® Flights & Hotels Booking WP Plugin adiaha-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flights & Hotels Booking WP Plugin: from n/a through = 3.1...

PT-2025-43772

Authorization Bypass Through User-Controlled Key vulnerability in mediavine Create by Mediavine mediavine-create allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Create by Mediavine: from n/a through = 1.9.14...

PT-2025-43783

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Justin Tadlock Query Posts query-posts allows Stored XSS.This issue affects Query Posts: from n/a through = 0.3.2...

CVE-2025-12285

Missing Initial Password Change.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

WordPress FileBird Pro plugin <= 6.5.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin FileBird Pro versions = 6.5.1...

CVE-2025-12220 Busybox 1.31.1 - Multiple Known Vulnerabilities

Busybox 1.31.1 - Multiple Known Vulnerabilities.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

CVE-2025-12219

CVE-2025-12219 concerns Azure Access OS vulnerabilities in the BLU-IC2 and BLU-IC4 family. Affected components are Azure Access OS on BLU-IC2/BLU-IC4 up to version 1.19.5; versions prior to 1.19.5 are vulnerable. The issue arises from the use of vulnerable components within Azure Access OS. Impac...

EUVD-2025-35928

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to SQL Injection via the donationids parameter in all versions up to, and including, 1.8.8.4 due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2025-35918

The SpendeOnline.org plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'spendeonline' shortcode in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...