WordPress LambertGroup - AllInOne - Banner with Playlist Plugin <= 3.8 - SQL Injection Vulnerability

WordPress LambertGroup - AllInOne - Banner with Playlist Plugin = 3.8 - SQL Injection Vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin LambertGroup - AllInOne - Banner with Playlist versions = 3.8...

CVE-2025-60141

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thetechtribe The Tribal the-tech-tribe allows Stored XSS.This issue affects The Tribal: from n/a through = 1.3.3...

CVE-2025-60128

Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through = 1.1.3...

CVE-2025-60111

Cross-Site Request Forgery CSRF vulnerability in javothemes Javo Core javo-core allows Authentication Bypass.This issue affects Javo Core: from n/a through = 3.0.0.266...

CVE-2025-60113

Cross-Site Request Forgery CSRF vulnerability in grooni Groovy Menu groovy-menu-free allows Cross Site Request Forgery.This issue affects Groovy Menu: from n/a through = 1.4.3...

CVE-2025-60186 WordPress Google+ Comments Plugin <= 1.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Alex Moss Google+ Comments google-plus-comments allows Stored XSS.This issue affects Google+ Comments: from n/a through = 1.0...

CVE-2025-60179

Technical details about CVE-2025-60179 are not provided in the supplied documents; no concrete product/version impact or fix information is available here. Monitor for updates from official sources.

CVE-2025-60177

CVE-2025-60177 describes a Stored XSS in the Recaptcha – wp WordPress plugin. Affected: Recaptcha – wp from n/a through 0.2.6. Root cause: improper neutralization of input during web page generation. Impact per CVSS: Confidentiality/Integrity/Availability Low, but attacker requires High privilege...

CVE-2025-60177 WordPress Recaptcha – wp Plugin <= 0.2.6 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in rozx Recaptcha – wp recaptcha-wp allows Stored XSS.This issue affects Recaptcha – wp: from n/a through = 0.2.6...

CVE-2025-60164

CVE-2025-60164 describes a CSRF flaw in the WordPress plugin NewsmanApp that enables a Stored XSS vector in versions up to 2.7.7 . The Connected documents identify the affected product and vulnerability type, but there are no details on exploits, exact impact beyond stored XSS, or a patch/recomme...

CVE-2025-60154 WordPress MWW Disclaimer Buttons plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jennifer Moss MWW Disclaimer Buttons mww-disclaimer-buttons allows Stored XSS.This issue affects MWW Disclaimer Buttons: from n/a through = 3.41...

CVE-2025-60152 WordPress Subscribe To Unlock Plugin <= 1.1.5 - Broken Access Control Vulnerability

Missing Authorization vulnerability in wpshuffle Subscribe To Unlock subscribe-to-unlock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Subscribe To Unlock: from n/a through = 1.1.5...

CVE-2025-60149

CVE-2025-60149 affects Notely (WordPress plugin). Reported as Stored XSS due to Improper Input Neutralization during Web Page Generation. Affected: Notely versions up to 1.8.0. Required access: authenticated (Administrator+). Description and context come from the CVE entry and the Wordfence vulne...

CVE-2025-60144 WordPress Lenix scss compiler Plugin <= 1.2 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in yonifre Lenix scss compiler lenix-scss-compiler allows Stored XSS.This issue affects Lenix scss compiler: from n/a through = 1.2...

CVE-2025-60143 WordPress Netgsm plugin <= 2.9.69 - Broken Access Control vulnerability

Missing Authorization vulnerability in netgsm Netgsm netgsm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Netgsm: from n/a through = 2.9.69...

CVE-2025-60141

CVE-2025-60141 is a stored XSS issue in the Tribal WordPress plugin. The vulnerability is caused by improper input neutralization during web page generation and is exploitable only by authenticated users with Administrator+ privileges. Affected versions: The Tribal up to 1.3.3. The Wordfence entr...

CVE-2025-60129

CVE-2025-60129: Missing Authorization in the Yext WordPress plugin (affected versions: n/a–1.1.3) allows accessing functionality not properly constrained by ACLs. The entry lists a basic impact (low) with no documented exploit details in the provided data, and no connected documents specify root ...

CVE-2025-60128 WordPress Delisho Plugin <= 1.1.3 - Broken Access Control Vulnerability

Missing Authorization vulnerability in WP Delicious Delisho dr-widgets-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delisho: from n/a through = 1.1.3...

CVE-2025-60128

CVE-2025-60128 affects the Delisho WordPress plugin (Delisho – Recipe Widgets and Blocks) up to version 1.1.3. The issue is Missing Authorization allowing unauthorized updates to Options via wcmlim_settings_ajax_handler, as documented in the CVE entry and corroborated by the Wordfence vulnerabili...

CVE-2025-60117 WordPress Vehica Core Plugin <= 1.0.100 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in TangibleWP Vehica Core vehica-core allows Cross Site Request Forgery.This issue affects Vehica Core: from n/a through = 1.0.100...