CVE-2025-69311

CVE-2025-69311 concerns the WordPress Broadstreet Ads plugin (versions <= 1.52.1). The vulnerability is described as a Missing Authorization / Broken Access Control issue where access control misconfigurations could be exploited. Public disclosures from Wordfence and CVE records corroborate th...

CVE-2025-69190 WordPress Listihub theme <= 1.0.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through = 1.0.6...

CVE-2025-69190

Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Listihub: from n/a through = 1.0.6...

CVE-2025-69292

CVE-2025-69292 affects WP Membership (wp-membership) for WordPress,

CVE-2025-69186 WordPress Hospital Doctor Directory plugin <= 1.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hospital Doctor Directory: from n/a through = 1.3.9...

CVE-2025-69185

The CVE-2025-69185 entry maps to a Missing Authorization / Broken Access Control vulnerability in the WordPress Hotel Listing plugin (versions

CVE-2025-69187

Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Final User: from n/a through = 1.2.5...

CVE-2025-69184 WordPress Institutions Directory plugin <= 1.3.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through = 1.3.4...

CVE-2025-69184

Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Institutions Directory: from n/a through = 1.3.4...

CVE-2025-69102

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflected XSS.This issue affects WP Test Email: from n/a through = 1.1.7...

CVE-2025-69095

Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through = 1.7...

CVE-2025-69079

CVE-2025-69079 describes a Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musicplace WordPress theme (Sound | Musical Instruments Online Store) that allows Object Injection. Affected software: Theme musicplace WordPress theme versions from n/a up to and including 1.6.9. Root ...

CVE-2025-69074 WordPress Pearson Specter theme <= 1.11.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Pearson Specter pearsonspecter allows PHP Local File Inclusion.This issue affects Pearson Specter: from n/a through = 1.11.3...

CVE-2025-69065 WordPress Snow Mountain theme <= 1.4.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in AncoraThemes Snow Mountain snowmountain allows PHP Local File Inclusion.This issue affects Snow Mountain: from n/a through = 1.4.3...

CVE-2025-69060

CVE-2025-69060 describes an Unrestricted Local File Inclusion in AncoraThemes uReach (WordPress theme/plugin: ureach). The root cause is Improper Control of Filename for Include/Require in a PHP program, enabling a PHP Local File Inclusion condition. Affected: uReach versions up to and including ...

CVE-2025-69052 WordPress Registration & Login with Mobile Phone Number for WooCommerce plugin <= 1.3.1 - Broken Access Control vulnerability

Missing Authorization vulnerability in FmeAddons Registration & Login with Mobile Phone Number for WooCommerce registration-login-with-mobile-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Registration & Login with Mobile Phone Number for...

CVE-2025-69051 WordPress ListingPro Reviews theme <= 1.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CridioStudio ListingPro Reviews listingpro-reviews allows Reflected XSS.This issue affects ListingPro Reviews: from n/a through 2.9.11...

CVE-2025-69043 WordPress Rashy theme <= 1.1.3 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Rashy rashy allows PHP Local File Inclusion.This issue affects Rashy: from n/a through = 1.1.3...

CVE-2025-69042 WordPress Lindo theme <= 1.2.5 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in goalthemes Lindo lindo allows PHP Local File Inclusion.This issue affects Lindo: from n/a through = 1.2.5...

CVE-2025-69042

CVE-2025-69042 affects WordPress theme Lindo (GoalThemes) up to 1.2.5. The issue is an improper control of filenames for include/require statements in PHP, enabling Local File Inclusion (LFI) via the theme’s PHP code. The impact is described as PHP Local File Inclusion affecting Lindo; specific e...