CVE-2025-66092

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bqworks Accordion Slider accordion-slider allows Stored XSS.This issue affects Accordion Slider: from n/a through = 1.9.13...

CVE-2025-66085

Missing Authorization vulnerability in tychesoftwares Arconix Shortcodes arconix-shortcodes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arconix Shortcodes: from n/a through = 2.1.18...

CVE-2025-66071

Missing Authorization vulnerability in tychesoftwares Custom Order Numbers for WooCommerce custom-order-numbers-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Custom Order Numbers for WooCommerce: from n/a through = 1.11.0...

CVE-2025-66072

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through = 1.2.47...

CVE-2025-66066

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This issue affects Envo Extra: from n/a through = 1.9.11...

CVE-2025-66060

Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through = 3.13.0...

CVE-2025-66111 WordPress Nelio Popups plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nelio Software Nelio Popups nelio-popups allows Stored XSS.This issue affects Nelio Popups: from n/a through = 1.3.0...

CVE-2025-66097 WordPress I Order Terms plugin <= 1.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Igor Jerosimić I Order Terms i-order-terms allows Cross Site Request Forgery.This issue affects I Order Terms: from n/a through = 1.5.0...

CVE-2025-66097

CVE-2025-66097 concerns the WordPress plugin I Order Terms (i-order-terms) with a CSRF vulnerability affecting versions up to and including 1.5.0. The connected reports describe a CSRF flaw stemming from inadequate request verification, enabling forged requests to perform sensitive actions. No ex...

CVE-2025-66089

CVE-2025-66089 concerns the WebToffee Product Feed for WooCommerce plugin (Wordpress) versions up to and including 2.3.1, with a Missing Authorization vulnerability enabling exploitation of incorrectly configured access control. The CVSS v3.1 base score is 4.3 (Medium), and the exploit vector is ...

CVE-2025-66087

CVE-2025-66087 affects WordPress Property Hive plugin (

CVE-2025-66085

CVE-2025-66085 concerns a missing/weak authorization in the WordPress plugin Arconix Shortcodes (versions up to and including 2.1.18). The connected CNVD/Red Hat/EUVD/NVD entries corroborate a broken access control vulnerability permitting unauthorized access due to misconfigured access controls....

CVE-2025-66077 WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through = 1.4.6...

CVE-2025-66077 WordPress Legal Pages plugin <= 1.4.6 - Broken Access Control vulnerability

Missing Authorization vulnerability in wpWax Legal Pages legal-pages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Legal Pages: from n/a through = 1.4.6...

CVE-2025-66072 WordPress UsersWP plugin <= 1.2.47 - Broken Access Control vulnerability

Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UsersWP: from n/a through = 1.2.47...

CVE-2025-66073

CVE-2025-66073 describes a Deserialization of Untrusted Data vulnerability in the WordPress plugin WP Webhooks (wp-webhooks) by Cozmoslabs, affecting versions up to and including 3.3.8. The issue enables PHP object injection via deserialized data, enabling an attacker with Administrator+ privileg...

CVE-2025-66066

CVE-2025-66066: Stored XSS in WordPress plugin Envo Extra (

CVE-2025-66064 WordPress Giveaways and Contests by RafflePress plugin <= 1.12.20 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Syed Balkhi Giveaways and Contests by RafflePress rafflepress allows Cross Site Request Forgery.This issue affects Giveaways and Contests by RafflePress: from n/a through = 1.12.20...

CVE-2025-66066 WordPress Envo Extra plugin <= 1.9.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in EnvoThemes Envo Extra envo-extra allows Stored XSS.This issue affects Envo Extra: from n/a through = 1.9.11...

CVE-2025-66060 WordPress Seriously Simple Podcasting plugin <= 3.13.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through = 3.13.0...