9967 matches found
CVE-2025-3809
The CVE-2025-3809 entry concerns the WordPress Debug Log Manager plugin, which has an unauthenticated Stored XSS vulnerability in the auto-refresh debug log feature. Affected versions include all up to and including 2.3.4, with exploitation enabling injection of scripts that run when users open t...
CVE-2025-2111
CVE-2025-2111 concerns the WordPress plugin Insert Headers And Footers (versions up to 3.1.1). The root cause is missing/incorrect nonce validation in the function custom_plugin_set_option , enabling Cross-Site Request Forgery (CSRF). By forged requests, unauthenticated attackers could update arb...
CVE-2025-2111 WP Headers And Footers <= 3.1.1 - Cross-Site Request Forgery to Arbitrary Options Update
The Insert Headers And Footers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.1. This is due to missing or incorrect nonce validation on the 'custompluginsetoption' function. This makes it possible for unauthenticated attackers to update...
CVE-2025-3278
The UrbanGo Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.4. This is due to the plugin allowing users who are registering new accounts to set their own role or by supplying 'userregisterrole' field. This makes it possible for...
CVE-2025-2010
The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
EUVD-2025-11919
The JobWP – Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...
CVE-2025-3284 User Registration & Membership PRO – Custom Registration Form, Login Form, and User Profile <= 5.1.3 - Cross-Site Request Forgery to User Deletion
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.3. This is due to missing or incorrect nonce validation on the userregistrationprodeleteaccount...
CVE-2025-3598
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commissionsummary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-3598 Coupon Affiliates – Affiliate Plugin for WooCommerce <= 6.3.0 - Reflected Cross-Site Scripting via 'commission_summary' Parameter
The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commissionsummary parameter in all versions up to, and including, .6.3.0 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2025-3598
CVE-2025-3598 concerns the Coupon Affiliates – Affiliate Plugin for WooCommerce for WordPress. It is a reflected Cross-Site Scripting vulnerability exploitable via the commission_summary parameter in all versions up to and including 6.3.0, caused by insufficient input sanitization and output esca...
CVE-2024-13452
The Contact Form by Supsystic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.29. This is due to missing or incorrect nonce validation on a saveAsCopy function. This makes it possible for unauthenticated attackers to update settings and...
CVE-2025-30514
Unauthenticated attackers can obtain restricted information about a user's smart device collections i.e., "scenes"...
CVE-2025-30257
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...
CVE-2025-30512
Unauthenticated attackers can send configuration settings to device and possible perform physical actions remotely e.g., on/off...
CVE-2025-27719
Unauthenticated attackers can query an API endpoint and get device details...
CVE-2025-27561
Unauthenticated attackers can rename "rooms" of arbitrary users...
CVE-2025-27938
Unauthenticated attackers can obtain restricted information about a user's smart device collections i.e., "rooms"...
CVE-2025-27929
Unauthenticated attackers can retrieve full list of users associated with arbitrary accounts...