CVE-2023-5049

The Giveaways and Contests by RafflePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rafflepress' and 'rafflepressgutenberg' shortcode in versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping on 'giframe' user supplied...

CVE-2023-27436

Cross-Site Request Forgery CSRF vulnerability in Louis Reingold Elegant Custom Fonts plugin = 1.0 versions...

CVE-2022-47588

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1...

CVE-2025-39519 WordPress Bulk Page Stub Creator plugin <= 1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rtpHarry Bulk Page Stub Creator allows Reflected XSS. This issue affects Bulk Page Stub Creator: from n/a through 1.1...

CVE-2025-39516

The CVE-2025-39516 entry is tied to the WordPress plugin Author WIP Progress Bar. The connected sources specify a DOM-based XSS due to improper input neutralization during web page generation, affecting Author WIP Progress Bar versions from n/a through 1.0. The initial and related records do not ...

CVE-2025-32132

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in FunnelCockpit FunnelCockpit funnelcockpit allows Stored XSS.This issue affects FunnelCockpit: from n/a through = 1.4.3...

CVE-2025-31446 WordPress WP Cleaner plugin <= 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in jiangmiao WP Cleaner allows Reflected XSS. This issue affects WP Cleaner: from n/a through 1.1.5...

CVE-2025-31910

Technical details for CVE-2025-31910 are not provided in the Connected documents. The Initial Description notes a SQL Injection in BookingPress

CVE-2025-31788

CVE-2025-31788 affects the AIO Performance Profiler, Monitor, Optimize, Compress & Debug plugin family. The issue is an Insertion of Sensitive Information into Log File, enabling unauthenticated exposure of embedded data via log contents. Affected versions are reported as up to 1.2 (n/a to 1.2). ...

CVE-2025-31466 WordPress Duplicate Page and Post plugin <= 1.0 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Falcon Solutions Duplicate Page and Post duplicate-post-and-page allows Blind SQL Injection.This issue affects Duplicate Page and Post: from n/a through = 1.0...

WordPress Custom Dashboard Page plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross Site Request Forgery CSRF vulnerability discovered by Nguyen Thi Huyen Trang - Skalucy in WordPress Plugin Custom Dashboard Page versions = 1.0...

CVE-2024-13864 Countdown Timer <= 1.0 - Reflected XSS

The Countdown Timer WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-23575

The CVE-2025-23575 entry concerns the WordPress DX Sales CRM plugin (versions

CVE-2024-13751

The 3D Photo Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'des' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and...

WordPress Simple Pricing Tables For WPBakery Page Builder plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Simple Pricing Tables For WPBakery Page Builder versions = 1.0...

CVE-2024-51709

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in mariandz TeleAdmin teleadmin allows Reflected XSS.This issue affects TeleAdmin: from n/a through = 1.0.0...

WordPress Migrate Posts Plugin <=1.0 - Post Based Cross Site Scripting (XSS) vulnerability

Post Based Cross Site Scripting XSS vulnerability discovered by wackydawg in WordPress Plugin Migrate Posts versions = 1.0...

WordPress PDF.js Shortcode plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO in WordPress Plugin PDF.js Shortcode versions = 1.0...

WordPress Instabot plugin <= 1.10 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Instabot versions = 1.10...

CVE-2024-55985 WordPress YDS Support Ticket System plugin <= 1.0 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ydesignservices YDS Support Ticket System yds-support-ticket-system allows SQL Injection.This issue affects YDS Support Ticket System: from n/a through = 1.0...