CVE-2025-53460 WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi AffiliateWP – External Referral Links affiliatewp-external-referral-links allows Stored XSS.This issue affects AffiliateWP – External Referral Links: from n/a through = 1.2.0...

CVE-2025-53460 WordPress AffiliateWP – External Referral Links Plugin <= 1.2.0 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Balkhi AffiliateWP – External Referral Links allows Stored XSS. This issue affects AffiliateWP – External Referral Links: from n/a through 1.2.0...

CVE-2025-53461 WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Binsaifullah Beaf allows Server Side Request Forgery. This issue affects Beaf: from n/a through 1.6.2...

CVE-2025-53461

CVE-2025-53461 is a Server-Side Request Forgery (SSRF) vulnerability in Beaf (Beaf – Photo Comparison Block) affecting Beaf versions up to 1.6.2. The Beaf entry (Beaf

CVE-2025-53461 WordPress Beaf Plugin <= 1.6.2 - Server Side Request Forgery (SSRF) Vulnerability

Server-Side Request Forgery SSRF vulnerability in Binsaifullah Beaf image-compare-block allows Server Side Request Forgery.This issue affects Beaf: from n/a through = 1.6.2...

CVE-2025-53468

CVE-2025-53468 describes an SQL Injection in the WordPress plugin WP Tabber Widget (Wp tabber widget) affecting versions up to 4.0. The vulnerability is listed as authenticated (Contributor+) SQL Injection, with a CVSS 3.1 base metric of 8.5 (HIGH). Connected sources indicate patch status as Unpa...

CVE-2025-57907 WordPress Heureka Plugin <= 1.1.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Heureka Group Heureka allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Heureka: from n/a through 1.1.0...

CVE-2025-57924

CVE-2025-57924 is a CSRF vulnerability in the Automattic Developer WordPress plugin, affecting versions up to 1.2.6. The provided data include CVSS 3.1 metrics (3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N with base score 4.3). No exploit details or remediation are provided in the documents.

CVE-2025-57936 WordPress Subresource Integrity (SRI) Manager Plugin <= 0.4.0 - Broken Access Control Vulnerability

Missing Authorization vulnerability in Meitar Subresource Integrity SRI Manager allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Subresource Integrity SRI Manager: from n/a through 0.4.0...

CVE-2025-57959

CVE-2025-57959 : The connected vulnerability details show a Stored Cross-Site Scripting in the WordPress plugin “Slightly troublesome permalink.” Exploitation requires an authenticated user (Administrator+), and the issue affects versions up to 1.2.0. The CVE entry and related references confirm ...

CVE-2025-57970

Technical details for CVE-2025-57970 are not provided in the connected documents. A related SALESmanago item (CVE-2025-57971) mentions missing authorization, but does not provide CVE-2025-57970 specifics; monitor for updates.

CVE-2025-57971 WordPress SALESmanago Plugin <= 3.8.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in SALESmanago SALESmanago & Leadoo salesmanago allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SALESmanago & Leadoo: from n/a through = 3.8.1...

CVE-2025-57974

CVE-2025-57974 documents a Cross‑Site Scripting (Stored XSS) vulnerability in the WordPress plugin TZ Plus Gallery. Affected range: TZ Plus Gallery

CVE-2025-57985 WordPress Ultimate Watermark Plugin <= 1.1 - Broken Access Control Vulnerability

Missing Authorization vulnerability in MantraBrain Ultimate Watermark ultimate-watermark allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ultimate Watermark: from n/a through = 1.1...

CVE-2025-57996 WordPress Buckets Plugin <= 0.3.9 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in matthewordie Buckets buckets allows Stored XSS.This issue affects Buckets: from n/a through = 0.3.9...

CVE-2025-58000

CVE-2025-58000 is a Missing Authorization vulnerability in the Memberful WordPress plugin (Memberful – Membership Plugin) that allows accessing functionality not properly constrained by ACLs. Affected software: Memberful, version range from unknown up through 1.75.0. Root cause: Missing authoriza...

CVE-2025-58007 WordPress Social Pug Plugin <= 1.35.1 - Sensitive Data Exposure Vulnerability

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in NerdPress Social Pug allows Retrieve Embedded Sensitive Data. This issue affects Social Pug: from n/a through 1.35.1...

CVE-2025-58010

Technical details beyond the initial description are not provided in the connected documents. The CSRF issue in SV Proven Expert for WordPress is described only at a high level; monitor for updates for affected versions and fixes.

CVE-2025-58010 WordPress SV Proven Expert Plugin <= 2.0.06 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in straightvisions GmbH SV Proven Expert sv-provenexpert allows Cross Site Request Forgery.This issue affects SV Proven Expert: from n/a through = 2.0.06...

CVE-2025-58011 WordPress Content Mask plugin <= 1.8.5.2 - Server Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability in Alex Content Mask content-mask allows Server Side Request Forgery.This issue affects Content Mask: from n/a through = 1.8.5.2...