WordPress Mail Mint Plugin <= 1.18.6 - SQL Injection Vulnerability

SQL Injection Vulnerability discovered by Le Cong Danh vodanh in WordPress Plugin Mail Mint versions = 1.18.6...

CVE-2025-58973

CVE-2025-58973 is a PHP Remote File Inclusion/Local File Inclusion vulnerability in Easy Elementor Addons (WordPress plugin). The issue arises from improper control of the filename used in include/require, enabling Local File Inclusion. Affected versions are Easy Elementor Addons up to 2.2.8 (no ...

CVE-2025-59569 WordPress CubeWP Plugin <= 1.1.26 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Imran Tauqeer CubeWP cubewp-framework allows Stored XSS.This issue affects CubeWP: from n/a through = 1.1.26...

CVE-2025-59585 WordPress Penci Recipe Plugin <= 4.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PenciDesign Penci Recipe penci-recipe allows DOM-Based XSS.This issue affects Penci Recipe: from n/a through = 4.0...

CVE-2025-53456 WordPress SEO Backlink Monitor Plugin <= 1.6.0 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in activewebsight SEO Backlink Monitor allows Cross Site Request Forgery. This issue affects SEO Backlink Monitor: from n/a through 1.6.0...

CVE-2025-53456 WordPress SEO Backlink Monitor plugin <= 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in activewebsight SEO Backlink Monitor seo-backlink-monitor allows Cross Site Request Forgery.This issue affects SEO Backlink Monitor: from n/a through = 1.8.0...

CVE-2025-53460 WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi AffiliateWP – External Referral Links allows Stored XSS. This issue affects AffiliateWP – External Referral Links: from n/a through 1.2.0...

CVE-2025-53461 WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Binsaifullah Beaf image-compare-block allows Server Side Request Forgery.This issue affects Beaf: from n/a through = 1.6.2...

CVE-2025-53460 WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through = 1.2.0...

CVE-2025-53461 WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Binsaifullah Beaf allows Server Side Request Forgery. This issue affects Beaf: from n/a through 1.6.2...

CVE-2025-53461

CVE-2025-53461 is a Server-Side Request Forgery (SSRF) vulnerability in Beaf (Beaf – Photo Comparison Block) affecting Beaf versions up to 1.6.2. The Beaf entry (Beaf

CVE-2025-53468

CVE-2025-53468 describes an SQL Injection in the WordPress plugin WP Tabber Widget (Wp tabber widget) affecting versions up to 4.0. The vulnerability is listed as authenticated (Contributor+) SQL Injection, with a CVSS 3.1 base metric of 8.5 (HIGH). Connected sources indicate patch status as Unpa...

CVE-2025-57907 WordPress Heureka Plugin <= 1.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Heureka Group Heureka allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Heureka: from n/a through 1.1.0...

CVE-2025-57924

CVE-2025-57924 is a CSRF vulnerability in the Automattic Developer WordPress plugin, affecting versions up to 1.2.6. The provided data include CVSS 3.1 metrics (3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N with base score 4.3). No exploit details or remediation are provided in the documents.

CVE-2025-57936 WordPress Subresource Integrity (SRI) Manager Plugin <= 0.4.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Meitar Subresource Integrity SRI Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subresource Integrity SRI Manager: from n/a through 0.4.0...

CVE-2025-57959

CVE-2025-57959 : The connected vulnerability details show a Stored Cross-Site Scripting in the WordPress plugin “Slightly troublesome permalink.” Exploitation requires an authenticated user (Administrator+), and the issue affects versions up to 1.2.0. The CVE entry and related references confirm ...

CVE-2025-57970

Technical details for CVE-2025-57970 are not provided in the connected documents. A related SALESmanago item (CVE-2025-57971) mentions missing authorization, but does not provide CVE-2025-57970 specifics; monitor for updates.

CVE-2025-57971 WordPress SALESmanago Plugin <= 3.8.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through = 3.8.1...

CVE-2025-57974

CVE-2025-57974 documents a Cross‑Site Scripting (Stored XSS) vulnerability in the WordPress plugin TZ Plus Gallery. Affected range: TZ Plus Gallery

CVE-2025-57985 WordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through = 1.1...